security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 extern struct security_operations *security_ops;
  99
 100 /* SECMARK reference count */
 101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 102
 103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 104 int selinux_enforcing;
 105
 106 static int __init enforcing_setup(char *str)
 107 {
 108         unsigned long enforcing;
 109         if (!kstrtoul(str, 0, &enforcing))
 110                 selinux_enforcing = enforcing ? 1 : 0;
 111         return 1;
 112 }
 113 __setup("enforcing=", enforcing_setup);
 114 #endif
 115
 116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 118
 119 static int __init selinux_enabled_setup(char *str)
 120 {
 121         unsigned long enabled;
 122         if (!kstrtoul(str, 0, &enabled))
 123                 selinux_enabled = enabled ? 1 : 0;
 124         return 1;
 125 }
 126 __setup("selinux=", selinux_enabled_setup);
 127 #else
 128 int selinux_enabled = 1;
 129 #endif
 130
 131 static struct kmem_cache *sel_inode_cache;
 132
 133 /**
 134  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 135  *
 136  * Description:
 137  * This function checks the SECMARK reference counter to see if any SECMARK
 138  * targets are currently configured, if the reference counter is greater than
 139  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 140  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 141  * policy capability is enabled, SECMARK is always considered enabled.
 142  *
 143  */
 144 static int selinux_secmark_enabled(void)
 145 {
 146         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 147 }
 148
 149 /**
 150  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 151  *
 152  * Description:
 153  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 154  * (1) if any are enabled or false (0) if neither are enabled.  If the
 155  * always_check_network policy capability is enabled, peer labeling
 156  * is always considered enabled.
 157  *
 158  */
 159 static int selinux_peerlbl_enabled(void)
 160 {
 161         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 162 }
 163
 164 /*
 165  * initialise the security for the init task
 166  */
 167 static void cred_init_security(void)
 168 {
 169         struct cred *cred = (struct cred *) current->real_cred;
 170         struct task_security_struct *tsec;
 171
 172         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 173         if (!tsec)
 174                 panic("SELinux:  Failed to initialize initial task.\n");
 175
 176         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 177         cred->security = tsec;
 178 }
 179
 180 /*
 181  * get the security ID of a set of credentials
 182  */
 183 static inline u32 cred_sid(const struct cred *cred)
 184 {
 185         const struct task_security_struct *tsec;
 186
 187         tsec = cred->security;
 188         return tsec->sid;
 189 }
 190
 191 /*
 192  * get the objective security ID of a task
 193  */
 194 static inline u32 task_sid(const struct task_struct *task)
 195 {
 196         u32 sid;
 197
 198         rcu_read_lock();
 199         sid = cred_sid(__task_cred(task));
 200         rcu_read_unlock();
 201         return sid;
 202 }
 203
 204 /*
 205  * get the subjective security ID of the current task
 206  */
 207 static inline u32 current_sid(void)
 208 {
 209         const struct task_security_struct *tsec = current_security();
 210
 211         return tsec->sid;
 212 }
 213
 214 /* Allocate and free functions for each kind of security blob. */
 215
 216 static int inode_alloc_security(struct inode *inode)
 217 {
 218         struct inode_security_struct *isec;
 219         u32 sid = current_sid();
 220
 221         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 222         if (!isec)
 223                 return -ENOMEM;
 224
 225         mutex_init(&isec->lock);
 226         INIT_LIST_HEAD(&isec->list);
 227         isec->inode = inode;
 228         isec->sid = SECINITSID_UNLABELED;
 229         isec->sclass = SECCLASS_FILE;
 230         isec->task_sid = sid;
 231         inode->i_security = isec;
 232
 233         return 0;
 234 }
 235
 236 static void inode_free_security(struct inode *inode)
 237 {
 238         struct inode_security_struct *isec = inode->i_security;
 239         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 240
 241         spin_lock(&sbsec->isec_lock);
 242         if (!list_empty(&isec->list))
 243                 list_del_init(&isec->list);
 244         spin_unlock(&sbsec->isec_lock);
 245
 246         inode->i_security = NULL;
 247         kmem_cache_free(sel_inode_cache, isec);
 248 }
 249
 250 static int file_alloc_security(struct file *file)
 251 {
 252         struct file_security_struct *fsec;
 253         u32 sid = current_sid();
 254
 255         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 256         if (!fsec)
 257                 return -ENOMEM;
 258
 259         fsec->sid = sid;
 260         fsec->fown_sid = sid;
 261         file->f_security = fsec;
 262
 263         return 0;
 264 }
 265
 266 static void file_free_security(struct file *file)
 267 {
 268         struct file_security_struct *fsec = file->f_security;
 269         file->f_security = NULL;
 270         kfree(fsec);
 271 }
 272
 273 static int superblock_alloc_security(struct super_block *sb)
 274 {
 275         struct superblock_security_struct *sbsec;
 276
 277         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 278         if (!sbsec)
 279                 return -ENOMEM;
 280
 281         mutex_init(&sbsec->lock);
 282         INIT_LIST_HEAD(&sbsec->isec_head);
 283         spin_lock_init(&sbsec->isec_lock);
 284         sbsec->sb = sb;
 285         sbsec->sid = SECINITSID_UNLABELED;
 286         sbsec->def_sid = SECINITSID_FILE;
 287         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 288         sb->s_security = sbsec;
 289
 290         return 0;
 291 }
 292
 293 static void superblock_free_security(struct super_block *sb)
 294 {
 295         struct superblock_security_struct *sbsec = sb->s_security;
 296         sb->s_security = NULL;
 297         kfree(sbsec);
 298 }
 299
 300 /* The file system's label must be initialized prior to use. */
 301
 302 static const char *labeling_behaviors[7] = {
 303         "uses xattr",
 304         "uses transition SIDs",
 305         "uses task SIDs",
 306         "uses genfs_contexts",
 307         "not configured for labeling",
 308         "uses mountpoint labeling",
 309         "uses native labeling",
 310 };
 311
 312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 313
 314 static inline int inode_doinit(struct inode *inode)
 315 {
 316         return inode_doinit_with_dentry(inode, NULL);
 317 }
 318
 319 enum {
 320         Opt_error = -1,
 321         Opt_context = 1,
 322         Opt_fscontext = 2,
 323         Opt_defcontext = 3,
 324         Opt_rootcontext = 4,
 325         Opt_labelsupport = 5,
 326         Opt_nextmntopt = 6,
 327 };
 328
 329 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 330
 331 static const match_table_t tokens = {
 332         {Opt_context, CONTEXT_STR "%s"},
 333         {Opt_fscontext, FSCONTEXT_STR "%s"},
 334         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 335         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 336         {Opt_labelsupport, LABELSUPP_STR},
 337         {Opt_error, NULL},
 338 };
 339
 340 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 341
 342 static int may_context_mount_sb_relabel(u32 sid,
 343                         struct superblock_security_struct *sbsec,
 344                         const struct cred *cred)
 345 {
 346         const struct task_security_struct *tsec = cred->security;
 347         int rc;
 348
 349         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 350                           FILESYSTEM__RELABELFROM, NULL);
 351         if (rc)
 352                 return rc;
 353
 354         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 355                           FILESYSTEM__RELABELTO, NULL);
 356         return rc;
 357 }
 358
 359 static int may_context_mount_inode_relabel(u32 sid,
 360                         struct superblock_security_struct *sbsec,
 361                         const struct cred *cred)
 362 {
 363         const struct task_security_struct *tsec = cred->security;
 364         int rc;
 365         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 366                           FILESYSTEM__RELABELFROM, NULL);
 367         if (rc)
 368                 return rc;
 369
 370         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 371                           FILESYSTEM__ASSOCIATE, NULL);
 372         return rc;
 373 }
 374
 375 static int selinux_is_sblabel_mnt(struct super_block *sb)
 376 {
 377         struct superblock_security_struct *sbsec = sb->s_security;
 378
 379         if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
 380             sbsec->behavior == SECURITY_FS_USE_TRANS ||
 381             sbsec->behavior == SECURITY_FS_USE_TASK)
 382                 return 1;
 383
 384         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 385         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 386                 return 1;
 387
 388         /*
 389          * Special handling for rootfs. Is genfs but supports
 390          * setting SELinux context on in-core inodes.
 391          */
 392         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 393                 return 1;
 394
 395         return 0;
 396 }
 397
 398 static int sb_finish_set_opts(struct super_block *sb)
 399 {
 400         struct superblock_security_struct *sbsec = sb->s_security;
 401         struct dentry *root = sb->s_root;
 402         struct inode *root_inode = root->d_inode;
 403         int rc = 0;
 404
 405         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 406                 /* Make sure that the xattr handler exists and that no
 407                    error other than -ENODATA is returned by getxattr on
 408                    the root directory.  -ENODATA is ok, as this may be
 409                    the first boot of the SELinux kernel before we have
 410                    assigned xattr values to the filesystem. */
 411                 if (!root_inode->i_op->getxattr) {
 412                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 413                                "xattr support\n", sb->s_id, sb->s_type->name);
 414                         rc = -EOPNOTSUPP;
 415                         goto out;
 416                 }
 417                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 418                 if (rc < 0 && rc != -ENODATA) {
 419                         if (rc == -EOPNOTSUPP)
 420                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 421                                        "%s) has no security xattr handler\n",
 422                                        sb->s_id, sb->s_type->name);
 423                         else
 424                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 425                                        "%s) getxattr errno %d\n", sb->s_id,
 426                                        sb->s_type->name, -rc);
 427                         goto out;
 428                 }
 429         }
 430
 431         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 432                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 433                        sb->s_id, sb->s_type->name);
 434         else
 435                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 436                        sb->s_id, sb->s_type->name,
 437                        labeling_behaviors[sbsec->behavior-1]);
 438
 439         sbsec->flags |= SE_SBINITIALIZED;
 440         if (selinux_is_sblabel_mnt(sb))
 441                 sbsec->flags |= SBLABEL_MNT;
 442
 443         /* Initialize the root inode. */
 444         rc = inode_doinit_with_dentry(root_inode, root);
 445
 446         /* Initialize any other inodes associated with the superblock, e.g.
 447            inodes created prior to initial policy load or inodes created
 448            during get_sb by a pseudo filesystem that directly
 449            populates itself. */
 450         spin_lock(&sbsec->isec_lock);
 451 next_inode:
 452         if (!list_empty(&sbsec->isec_head)) {
 453                 struct inode_security_struct *isec =
 454                                 list_entry(sbsec->isec_head.next,
 455                                            struct inode_security_struct, list);
 456                 struct inode *inode = isec->inode;
 457                 spin_unlock(&sbsec->isec_lock);
 458                 inode = igrab(inode);
 459                 if (inode) {
 460                         if (!IS_PRIVATE(inode))
 461                                 inode_doinit(inode);
 462                         iput(inode);
 463                 }
 464                 spin_lock(&sbsec->isec_lock);
 465                 list_del_init(&isec->list);
 466                 goto next_inode;
 467         }
 468         spin_unlock(&sbsec->isec_lock);
 469 out:
 470         return rc;
 471 }
 472
 473 /*
 474  * This function should allow an FS to ask what it's mount security
 475  * options were so it can use those later for submounts, displaying
 476  * mount options, or whatever.
 477  */
 478 static int selinux_get_mnt_opts(const struct super_block *sb,
 479                                 struct security_mnt_opts *opts)
 480 {
 481         int rc = 0, i;
 482         struct superblock_security_struct *sbsec = sb->s_security;
 483         char *context = NULL;
 484         u32 len;
 485         char tmp;
 486
 487         security_init_mnt_opts(opts);
 488
 489         if (!(sbsec->flags & SE_SBINITIALIZED))
 490                 return -EINVAL;
 491
 492         if (!ss_initialized)
 493                 return -EINVAL;
 494
 495         /* make sure we always check enough bits to cover the mask */
 496         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 497
 498         tmp = sbsec->flags & SE_MNTMASK;
 499         /* count the number of mount options for this sb */
 500         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 501                 if (tmp & 0x01)
 502                         opts->num_mnt_opts++;
 503                 tmp >>= 1;
 504         }
 505         /* Check if the Label support flag is set */
 506         if (sbsec->flags & SBLABEL_MNT)
 507                 opts->num_mnt_opts++;
 508
 509         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 510         if (!opts->mnt_opts) {
 511                 rc = -ENOMEM;
 512                 goto out_free;
 513         }
 514
 515         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 516         if (!opts->mnt_opts_flags) {
 517                 rc = -ENOMEM;
 518                 goto out_free;
 519         }
 520
 521         i = 0;
 522         if (sbsec->flags & FSCONTEXT_MNT) {
 523                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 524                 if (rc)
 525                         goto out_free;
 526                 opts->mnt_opts[i] = context;
 527                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 528         }
 529         if (sbsec->flags & CONTEXT_MNT) {
 530                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 531                 if (rc)
 532                         goto out_free;
 533                 opts->mnt_opts[i] = context;
 534                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 535         }
 536         if (sbsec->flags & DEFCONTEXT_MNT) {
 537                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 538                 if (rc)
 539                         goto out_free;
 540                 opts->mnt_opts[i] = context;
 541                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 542         }
 543         if (sbsec->flags & ROOTCONTEXT_MNT) {
 544                 struct inode *root = sbsec->sb->s_root->d_inode;
 545                 struct inode_security_struct *isec = root->i_security;
 546
 547                 rc = security_sid_to_context(isec->sid, &context, &len);
 548                 if (rc)
 549                         goto out_free;
 550                 opts->mnt_opts[i] = context;
 551                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 552         }
 553         if (sbsec->flags & SBLABEL_MNT) {
 554                 opts->mnt_opts[i] = NULL;
 555                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 556         }
 557
 558         BUG_ON(i != opts->num_mnt_opts);
 559
 560         return 0;
 561
 562 out_free:
 563         security_free_mnt_opts(opts);
 564         return rc;
 565 }
 566
 567 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 568                       u32 old_sid, u32 new_sid)
 569 {
 570         char mnt_flags = sbsec->flags & SE_MNTMASK;
 571
 572         /* check if the old mount command had the same options */
 573         if (sbsec->flags & SE_SBINITIALIZED)
 574                 if (!(sbsec->flags & flag) ||
 575                     (old_sid != new_sid))
 576                         return 1;
 577
 578         /* check if we were passed the same options twice,
 579          * aka someone passed context=a,context=b
 580          */
 581         if (!(sbsec->flags & SE_SBINITIALIZED))
 582                 if (mnt_flags & flag)
 583                         return 1;
 584         return 0;
 585 }
 586
 587 /*
 588  * Allow filesystems with binary mount data to explicitly set mount point
 589  * labeling information.
 590  */
 591 static int selinux_set_mnt_opts(struct super_block *sb,
 592                                 struct security_mnt_opts *opts,
 593                                 unsigned long kern_flags,
 594                                 unsigned long *set_kern_flags)
 595 {
 596         const struct cred *cred = current_cred();
 597         int rc = 0, i;
 598         struct superblock_security_struct *sbsec = sb->s_security;
 599         const char *name = sb->s_type->name;
 600         struct inode *inode = sbsec->sb->s_root->d_inode;
 601         struct inode_security_struct *root_isec = inode->i_security;
 602         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 603         u32 defcontext_sid = 0;
 604         char **mount_options = opts->mnt_opts;
 605         int *flags = opts->mnt_opts_flags;
 606         int num_opts = opts->num_mnt_opts;
 607
 608         mutex_lock(&sbsec->lock);
 609
 610         if (!ss_initialized) {
 611                 if (!num_opts) {
 612                         /* Defer initialization until selinux_complete_init,
 613                            after the initial policy is loaded and the security
 614                            server is ready to handle calls. */
 615                         goto out;
 616                 }
 617                 rc = -EINVAL;
 618                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 619                         "before the security server is initialized\n");
 620                 goto out;
 621         }
 622         if (kern_flags && !set_kern_flags) {
 623                 /* Specifying internal flags without providing a place to
 624                  * place the results is not allowed */
 625                 rc = -EINVAL;
 626                 goto out;
 627         }
 628
 629         /*
 630          * Binary mount data FS will come through this function twice.  Once
 631          * from an explicit call and once from the generic calls from the vfs.
 632          * Since the generic VFS calls will not contain any security mount data
 633          * we need to skip the double mount verification.
 634          *
 635          * This does open a hole in which we will not notice if the first
 636          * mount using this sb set explict options and a second mount using
 637          * this sb does not set any security options.  (The first options
 638          * will be used for both mounts)
 639          */
 640         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 641             && (num_opts == 0))
 642                 goto out;
 643
 644         /*
 645          * parse the mount options, check if they are valid sids.
 646          * also check if someone is trying to mount the same sb more
 647          * than once with different security options.
 648          */
 649         for (i = 0; i < num_opts; i++) {
 650                 u32 sid;
 651
 652                 if (flags[i] == SBLABEL_MNT)
 653                         continue;
 654                 rc = security_context_to_sid(mount_options[i],
 655                                              strlen(mount_options[i]), &sid);
 656                 if (rc) {
 657                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 658                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 659                                mount_options[i], sb->s_id, name, rc);
 660                         goto out;
 661                 }
 662                 switch (flags[i]) {
 663                 case FSCONTEXT_MNT:
 664                         fscontext_sid = sid;
 665
 666                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 667                                         fscontext_sid))
 668                                 goto out_double_mount;
 669
 670                         sbsec->flags |= FSCONTEXT_MNT;
 671                         break;
 672                 case CONTEXT_MNT:
 673                         context_sid = sid;
 674
 675                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 676                                         context_sid))
 677                                 goto out_double_mount;
 678
 679                         sbsec->flags |= CONTEXT_MNT;
 680                         break;
 681                 case ROOTCONTEXT_MNT:
 682                         rootcontext_sid = sid;
 683
 684                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 685                                         rootcontext_sid))
 686                                 goto out_double_mount;
 687
 688                         sbsec->flags |= ROOTCONTEXT_MNT;
 689
 690                         break;
 691                 case DEFCONTEXT_MNT:
 692                         defcontext_sid = sid;
 693
 694                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 695                                         defcontext_sid))
 696                                 goto out_double_mount;
 697
 698                         sbsec->flags |= DEFCONTEXT_MNT;
 699
 700                         break;
 701                 default:
 702                         rc = -EINVAL;
 703                         goto out;
 704                 }
 705         }
 706
 707         if (sbsec->flags & SE_SBINITIALIZED) {
 708                 /* previously mounted with options, but not on this attempt? */
 709                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 710                         goto out_double_mount;
 711                 rc = 0;
 712                 goto out;
 713         }
 714
 715         if (strcmp(sb->s_type->name, "proc") == 0)
 716                 sbsec->flags |= SE_SBPROC;
 717
 718         if (!sbsec->behavior) {
 719                 /*
 720                  * Determine the labeling behavior to use for this
 721                  * filesystem type.
 722                  */
 723                 rc = security_fs_use(sb);
 724                 if (rc) {
 725                         printk(KERN_WARNING
 726                                 "%s: security_fs_use(%s) returned %d\n",
 727                                         __func__, sb->s_type->name, rc);
 728                         goto out;
 729                 }
 730         }
 731         /* sets the context of the superblock for the fs being mounted. */
 732         if (fscontext_sid) {
 733                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 734                 if (rc)
 735                         goto out;
 736
 737                 sbsec->sid = fscontext_sid;
 738         }
 739
 740         /*
 741          * Switch to using mount point labeling behavior.
 742          * sets the label used on all file below the mountpoint, and will set
 743          * the superblock context if not already set.
 744          */
 745         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 746                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 747                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 748         }
 749
 750         if (context_sid) {
 751                 if (!fscontext_sid) {
 752                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 753                                                           cred);
 754                         if (rc)
 755                                 goto out;
 756                         sbsec->sid = context_sid;
 757                 } else {
 758                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 759                                                              cred);
 760                         if (rc)
 761                                 goto out;
 762                 }
 763                 if (!rootcontext_sid)
 764                         rootcontext_sid = context_sid;
 765
 766                 sbsec->mntpoint_sid = context_sid;
 767                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 768         }
 769
 770         if (rootcontext_sid) {
 771                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 772                                                      cred);
 773                 if (rc)
 774                         goto out;
 775
 776                 root_isec->sid = rootcontext_sid;
 777                 root_isec->initialized = 1;
 778         }
 779
 780         if (defcontext_sid) {
 781                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 782                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 783                         rc = -EINVAL;
 784                         printk(KERN_WARNING "SELinux: defcontext option is "
 785                                "invalid for this filesystem type\n");
 786                         goto out;
 787                 }
 788
 789                 if (defcontext_sid != sbsec->def_sid) {
 790                         rc = may_context_mount_inode_relabel(defcontext_sid,
 791                                                              sbsec, cred);
 792                         if (rc)
 793                                 goto out;
 794                 }
 795
 796                 sbsec->def_sid = defcontext_sid;
 797         }
 798
 799         rc = sb_finish_set_opts(sb);
 800 out:
 801         mutex_unlock(&sbsec->lock);
 802         return rc;
 803 out_double_mount:
 804         rc = -EINVAL;
 805         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 806                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 807         goto out;
 808 }
 809
 810 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 811                                     const struct super_block *newsb)
 812 {
 813         struct superblock_security_struct *old = oldsb->s_security;
 814         struct superblock_security_struct *new = newsb->s_security;
 815         char oldflags = old->flags & SE_MNTMASK;
 816         char newflags = new->flags & SE_MNTMASK;
 817
 818         if (oldflags != newflags)
 819                 goto mismatch;
 820         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 821                 goto mismatch;
 822         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 823                 goto mismatch;
 824         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 825                 goto mismatch;
 826         if (oldflags & ROOTCONTEXT_MNT) {
 827                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 828                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 829                 if (oldroot->sid != newroot->sid)
 830                         goto mismatch;
 831         }
 832         return 0;
 833 mismatch:
 834         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 835                             "different security settings for (dev %s, "
 836                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 837         return -EBUSY;
 838 }
 839
 840 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 841                                         struct super_block *newsb)
 842 {
 843         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 844         struct superblock_security_struct *newsbsec = newsb->s_security;
 845
 846         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 847         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 848         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 849
 850         /*
 851          * if the parent was able to be mounted it clearly had no special lsm
 852          * mount options.  thus we can safely deal with this superblock later
 853          */
 854         if (!ss_initialized)
 855                 return 0;
 856
 857         /* how can we clone if the old one wasn't set up?? */
 858         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 859
 860         /* if fs is reusing a sb, make sure that the contexts match */
 861         if (newsbsec->flags & SE_SBINITIALIZED)
 862                 return selinux_cmp_sb_context(oldsb, newsb);
 863
 864         mutex_lock(&newsbsec->lock);
 865
 866         newsbsec->flags = oldsbsec->flags;
 867
 868         newsbsec->sid = oldsbsec->sid;
 869         newsbsec->def_sid = oldsbsec->def_sid;
 870         newsbsec->behavior = oldsbsec->behavior;
 871
 872         if (set_context) {
 873                 u32 sid = oldsbsec->mntpoint_sid;
 874
 875                 if (!set_fscontext)
 876                         newsbsec->sid = sid;
 877                 if (!set_rootcontext) {
 878                         struct inode *newinode = newsb->s_root->d_inode;
 879                         struct inode_security_struct *newisec = newinode->i_security;
 880                         newisec->sid = sid;
 881                 }
 882                 newsbsec->mntpoint_sid = sid;
 883         }
 884         if (set_rootcontext) {
 885                 const struct inode *oldinode = oldsb->s_root->d_inode;
 886                 const struct inode_security_struct *oldisec = oldinode->i_security;
 887                 struct inode *newinode = newsb->s_root->d_inode;
 888                 struct inode_security_struct *newisec = newinode->i_security;
 889
 890                 newisec->sid = oldisec->sid;
 891         }
 892
 893         sb_finish_set_opts(newsb);
 894         mutex_unlock(&newsbsec->lock);
 895         return 0;
 896 }
 897
 898 static int selinux_parse_opts_str(char *options,
 899                                   struct security_mnt_opts *opts)
 900 {
 901         char *p;
 902         char *context = NULL, *defcontext = NULL;
 903         char *fscontext = NULL, *rootcontext = NULL;
 904         int rc, num_mnt_opts = 0;
 905
 906         opts->num_mnt_opts = 0;
 907
 908         /* Standard string-based options. */
 909         while ((p = strsep(&options, "|")) != NULL) {
 910                 int token;
 911                 substring_t args[MAX_OPT_ARGS];
 912
 913                 if (!*p)
 914                         continue;
 915
 916                 token = match_token(p, tokens, args);
 917
 918                 switch (token) {
 919                 case Opt_context:
 920                         if (context || defcontext) {
 921                                 rc = -EINVAL;
 922                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 923                                 goto out_err;
 924                         }
 925                         context = match_strdup(&args[0]);
 926                         if (!context) {
 927                                 rc = -ENOMEM;
 928                                 goto out_err;
 929                         }
 930                         break;
 931
 932                 case Opt_fscontext:
 933                         if (fscontext) {
 934                                 rc = -EINVAL;
 935                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 936                                 goto out_err;
 937                         }
 938                         fscontext = match_strdup(&args[0]);
 939                         if (!fscontext) {
 940                                 rc = -ENOMEM;
 941                                 goto out_err;
 942                         }
 943                         break;
 944
 945                 case Opt_rootcontext:
 946                         if (rootcontext) {
 947                                 rc = -EINVAL;
 948                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 949                                 goto out_err;
 950                         }
 951                         rootcontext = match_strdup(&args[0]);
 952                         if (!rootcontext) {
 953                                 rc = -ENOMEM;
 954                                 goto out_err;
 955                         }
 956                         break;
 957
 958                 case Opt_defcontext:
 959                         if (context || defcontext) {
 960                                 rc = -EINVAL;
 961                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 962                                 goto out_err;
 963                         }
 964                         defcontext = match_strdup(&args[0]);
 965                         if (!defcontext) {
 966                                 rc = -ENOMEM;
 967                                 goto out_err;
 968                         }
 969                         break;
 970                 case Opt_labelsupport:
 971                         break;
 972                 default:
 973                         rc = -EINVAL;
 974                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 975                         goto out_err;
 976
 977                 }
 978         }
 979
 980         rc = -ENOMEM;
 981         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 982         if (!opts->mnt_opts)
 983                 goto out_err;
 984
 985         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 986         if (!opts->mnt_opts_flags) {
 987                 kfree(opts->mnt_opts);
 988                 goto out_err;
 989         }
 990
 991         if (fscontext) {
 992                 opts->mnt_opts[num_mnt_opts] = fscontext;
 993                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 994         }
 995         if (context) {
 996                 opts->mnt_opts[num_mnt_opts] = context;
 997                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 998         }
 999         if (rootcontext) {
1000                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1001                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1002         }
1003         if (defcontext) {
1004                 opts->mnt_opts[num_mnt_opts] = defcontext;
1005                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1006         }
1007
1008         opts->num_mnt_opts = num_mnt_opts;
1009         return 0;
1010
1011 out_err:
1012         kfree(context);
1013         kfree(defcontext);
1014         kfree(fscontext);
1015         kfree(rootcontext);
1016         return rc;
1017 }
1018 /*
1019  * string mount options parsing and call set the sbsec
1020  */
1021 static int superblock_doinit(struct super_block *sb, void *data)
1022 {
1023         int rc = 0;
1024         char *options = data;
1025         struct security_mnt_opts opts;
1026
1027         security_init_mnt_opts(&opts);
1028
1029         if (!data)
1030                 goto out;
1031
1032         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1033
1034         rc = selinux_parse_opts_str(options, &opts);
1035         if (rc)
1036                 goto out_err;
1037
1038 out:
1039         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1040
1041 out_err:
1042         security_free_mnt_opts(&opts);
1043         return rc;
1044 }
1045
1046 static void selinux_write_opts(struct seq_file *m,
1047                                struct security_mnt_opts *opts)
1048 {
1049         int i;
1050         char *prefix;
1051
1052         for (i = 0; i < opts->num_mnt_opts; i++) {
1053                 char *has_comma;
1054
1055                 if (opts->mnt_opts[i])
1056                         has_comma = strchr(opts->mnt_opts[i], ',');
1057                 else
1058                         has_comma = NULL;
1059
1060                 switch (opts->mnt_opts_flags[i]) {
1061                 case CONTEXT_MNT:
1062                         prefix = CONTEXT_STR;
1063                         break;
1064                 case FSCONTEXT_MNT:
1065                         prefix = FSCONTEXT_STR;
1066                         break;
1067                 case ROOTCONTEXT_MNT:
1068                         prefix = ROOTCONTEXT_STR;
1069                         break;
1070                 case DEFCONTEXT_MNT:
1071                         prefix = DEFCONTEXT_STR;
1072                         break;
1073                 case SBLABEL_MNT:
1074                         seq_putc(m, ',');
1075                         seq_puts(m, LABELSUPP_STR);
1076                         continue;
1077                 default:
1078                         BUG();
1079                         return;
1080                 };
1081                 /* we need a comma before each option */
1082                 seq_putc(m, ',');
1083                 seq_puts(m, prefix);
1084                 if (has_comma)
1085                         seq_putc(m, '\"');
1086                 seq_puts(m, opts->mnt_opts[i]);
1087                 if (has_comma)
1088                         seq_putc(m, '\"');
1089         }
1090 }
1091
1092 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1093 {
1094         struct security_mnt_opts opts;
1095         int rc;
1096
1097         rc = selinux_get_mnt_opts(sb, &opts);
1098         if (rc) {
1099                 /* before policy load we may get EINVAL, don't show anything */
1100                 if (rc == -EINVAL)
1101                         rc = 0;
1102                 return rc;
1103         }
1104
1105         selinux_write_opts(m, &opts);
1106
1107         security_free_mnt_opts(&opts);
1108
1109         return rc;
1110 }
1111
1112 static inline u16 inode_mode_to_security_class(umode_t mode)
1113 {
1114         switch (mode & S_IFMT) {
1115         case S_IFSOCK:
1116                 return SECCLASS_SOCK_FILE;
1117         case S_IFLNK:
1118                 return SECCLASS_LNK_FILE;
1119         case S_IFREG:
1120                 return SECCLASS_FILE;
1121         case S_IFBLK:
1122                 return SECCLASS_BLK_FILE;
1123         case S_IFDIR:
1124                 return SECCLASS_DIR;
1125         case S_IFCHR:
1126                 return SECCLASS_CHR_FILE;
1127         case S_IFIFO:
1128                 return SECCLASS_FIFO_FILE;
1129
1130         }
1131
1132         return SECCLASS_FILE;
1133 }
1134
1135 static inline int default_protocol_stream(int protocol)
1136 {
1137         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1138 }
1139
1140 static inline int default_protocol_dgram(int protocol)
1141 {
1142         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1143 }
1144
1145 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1146 {
1147         switch (family) {
1148         case PF_UNIX:
1149                 switch (type) {
1150                 case SOCK_STREAM:
1151                 case SOCK_SEQPACKET:
1152                         return SECCLASS_UNIX_STREAM_SOCKET;
1153                 case SOCK_DGRAM:
1154                         return SECCLASS_UNIX_DGRAM_SOCKET;
1155                 }
1156                 break;
1157         case PF_INET:
1158         case PF_INET6:
1159                 switch (type) {
1160                 case SOCK_STREAM:
1161                         if (default_protocol_stream(protocol))
1162                                 return SECCLASS_TCP_SOCKET;
1163                         else
1164                                 return SECCLASS_RAWIP_SOCKET;
1165                 case SOCK_DGRAM:
1166                         if (default_protocol_dgram(protocol))
1167                                 return SECCLASS_UDP_SOCKET;
1168                         else
1169                                 return SECCLASS_RAWIP_SOCKET;
1170                 case SOCK_DCCP:
1171                         return SECCLASS_DCCP_SOCKET;
1172                 default:
1173                         return SECCLASS_RAWIP_SOCKET;
1174                 }
1175                 break;
1176         case PF_NETLINK:
1177                 switch (protocol) {
1178                 case NETLINK_ROUTE:
1179                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1180                 case NETLINK_FIREWALL:
1181                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1182                 case NETLINK_SOCK_DIAG:
1183                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1184                 case NETLINK_NFLOG:
1185                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1186                 case NETLINK_XFRM:
1187                         return SECCLASS_NETLINK_XFRM_SOCKET;
1188                 case NETLINK_SELINUX:
1189                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1190                 case NETLINK_AUDIT:
1191                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1192                 case NETLINK_IP6_FW:
1193                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1194                 case NETLINK_DNRTMSG:
1195                         return SECCLASS_NETLINK_DNRT_SOCKET;
1196                 case NETLINK_KOBJECT_UEVENT:
1197                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1198                 default:
1199                         return SECCLASS_NETLINK_SOCKET;
1200                 }
1201         case PF_PACKET:
1202                 return SECCLASS_PACKET_SOCKET;
1203         case PF_KEY:
1204                 return SECCLASS_KEY_SOCKET;
1205         case PF_APPLETALK:
1206                 return SECCLASS_APPLETALK_SOCKET;
1207         }
1208
1209         return SECCLASS_SOCKET;
1210 }
1211
1212 #ifdef CONFIG_PROC_FS
1213 static int selinux_proc_get_sid(struct dentry *dentry,
1214                                 u16 tclass,
1215                                 u32 *sid)
1216 {
1217         int rc;
1218         char *buffer, *path;
1219
1220         buffer = (char *)__get_free_page(GFP_KERNEL);
1221         if (!buffer)
1222                 return -ENOMEM;
1223
1224         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1225         if (IS_ERR(path))
1226                 rc = PTR_ERR(path);
1227         else {
1228                 /* each process gets a /proc/PID/ entry. Strip off the
1229                  * PID part to get a valid selinux labeling.
1230                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1231                 while (path[1] >= '0' && path[1] <= '9') {
1232                         path[1] = '/';
1233                         path++;
1234                 }
1235                 rc = security_genfs_sid("proc", path, tclass, sid);
1236         }
1237         free_page((unsigned long)buffer);
1238         return rc;
1239 }
1240 #else
1241 static int selinux_proc_get_sid(struct dentry *dentry,
1242                                 u16 tclass,
1243                                 u32 *sid)
1244 {
1245         return -EINVAL;
1246 }
1247 #endif
1248
1249 /* The inode's security attributes must be initialized before first use. */
1250 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1251 {
1252         struct superblock_security_struct *sbsec = NULL;
1253         struct inode_security_struct *isec = inode->i_security;
1254         u32 sid;
1255         struct dentry *dentry;
1256 #define INITCONTEXTLEN 255
1257         char *context = NULL;
1258         unsigned len = 0;
1259         int rc = 0;
1260
1261         if (isec->initialized)
1262                 goto out;
1263
1264         mutex_lock(&isec->lock);
1265         if (isec->initialized)
1266                 goto out_unlock;
1267
1268         sbsec = inode->i_sb->s_security;
1269         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1270                 /* Defer initialization until selinux_complete_init,
1271                    after the initial policy is loaded and the security
1272                    server is ready to handle calls. */
1273                 spin_lock(&sbsec->isec_lock);
1274                 if (list_empty(&isec->list))
1275                         list_add(&isec->list, &sbsec->isec_head);
1276                 spin_unlock(&sbsec->isec_lock);
1277                 goto out_unlock;
1278         }
1279
1280         switch (sbsec->behavior) {
1281         case SECURITY_FS_USE_NATIVE:
1282                 break;
1283         case SECURITY_FS_USE_XATTR:
1284                 if (!inode->i_op->getxattr) {
1285                         isec->sid = sbsec->def_sid;
1286                         break;
1287                 }
1288
1289                 /* Need a dentry, since the xattr API requires one.
1290                    Life would be simpler if we could just pass the inode. */
1291                 if (opt_dentry) {
1292                         /* Called from d_instantiate or d_splice_alias. */
1293                         dentry = dget(opt_dentry);
1294                 } else {
1295                         /* Called from selinux_complete_init, try to find a dentry. */
1296                         dentry = d_find_alias(inode);
1297                 }
1298                 if (!dentry) {
1299                         /*
1300                          * this is can be hit on boot when a file is accessed
1301                          * before the policy is loaded.  When we load policy we
1302                          * may find inodes that have no dentry on the
1303                          * sbsec->isec_head list.  No reason to complain as these
1304                          * will get fixed up the next time we go through
1305                          * inode_doinit with a dentry, before these inodes could
1306                          * be used again by userspace.
1307                          */
1308                         goto out_unlock;
1309                 }
1310
1311                 len = INITCONTEXTLEN;
1312                 context = kmalloc(len+1, GFP_NOFS);
1313                 if (!context) {
1314                         rc = -ENOMEM;
1315                         dput(dentry);
1316                         goto out_unlock;
1317                 }
1318                 context[len] = '\0';
1319                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1320                                            context, len);
1321                 if (rc == -ERANGE) {
1322                         kfree(context);
1323
1324                         /* Need a larger buffer.  Query for the right size. */
1325                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1326                                                    NULL, 0);
1327                         if (rc < 0) {
1328                                 dput(dentry);
1329                                 goto out_unlock;
1330                         }
1331                         len = rc;
1332                         context = kmalloc(len+1, GFP_NOFS);
1333                         if (!context) {
1334                                 rc = -ENOMEM;
1335                                 dput(dentry);
1336                                 goto out_unlock;
1337                         }
1338                         context[len] = '\0';
1339                         rc = inode->i_op->getxattr(dentry,
1340                                                    XATTR_NAME_SELINUX,
1341                                                    context, len);
1342                 }
1343                 dput(dentry);
1344                 if (rc < 0) {
1345                         if (rc != -ENODATA) {
1346                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1347                                        "%d for dev=%s ino=%ld\n", __func__,
1348                                        -rc, inode->i_sb->s_id, inode->i_ino);
1349                                 kfree(context);
1350                                 goto out_unlock;
1351                         }
1352                         /* Map ENODATA to the default file SID */
1353                         sid = sbsec->def_sid;
1354                         rc = 0;
1355                 } else {
1356                         rc = security_context_to_sid_default(context, rc, &sid,
1357                                                              sbsec->def_sid,
1358                                                              GFP_NOFS);
1359                         if (rc) {
1360                                 char *dev = inode->i_sb->s_id;
1361                                 unsigned long ino = inode->i_ino;
1362
1363                                 if (rc == -EINVAL) {
1364                                         if (printk_ratelimit())
1365                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1366                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1367                                                         "filesystem in question.\n", ino, dev, context);
1368                                 } else {
1369                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1370                                                "returned %d for dev=%s ino=%ld\n",
1371                                                __func__, context, -rc, dev, ino);
1372                                 }
1373                                 kfree(context);
1374                                 /* Leave with the unlabeled SID */
1375                                 rc = 0;
1376                                 break;
1377                         }
1378                 }
1379                 kfree(context);
1380                 isec->sid = sid;
1381                 break;
1382         case SECURITY_FS_USE_TASK:
1383                 isec->sid = isec->task_sid;
1384                 break;
1385         case SECURITY_FS_USE_TRANS:
1386                 /* Default to the fs SID. */
1387                 isec->sid = sbsec->sid;
1388
1389                 /* Try to obtain a transition SID. */
1390                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1391                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1392                                              isec->sclass, NULL, &sid);
1393                 if (rc)
1394                         goto out_unlock;
1395                 isec->sid = sid;
1396                 break;
1397         case SECURITY_FS_USE_MNTPOINT:
1398                 isec->sid = sbsec->mntpoint_sid;
1399                 break;
1400         default:
1401                 /* Default to the fs superblock SID. */
1402                 isec->sid = sbsec->sid;
1403
1404                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1405                         /* We must have a dentry to determine the label on
1406                          * procfs inodes */
1407                         if (opt_dentry)
1408                                 /* Called from d_instantiate or
1409                                  * d_splice_alias. */
1410                                 dentry = dget(opt_dentry);
1411                         else
1412                                 /* Called from selinux_complete_init, try to
1413                                  * find a dentry. */
1414                                 dentry = d_find_alias(inode);
1415                         /*
1416                          * This can be hit on boot when a file is accessed
1417                          * before the policy is loaded.  When we load policy we
1418                          * may find inodes that have no dentry on the
1419                          * sbsec->isec_head list.  No reason to complain as
1420                          * these will get fixed up the next time we go through
1421                          * inode_doinit() with a dentry, before these inodes
1422                          * could be used again by userspace.
1423                          */
1424                         if (!dentry)
1425                                 goto out_unlock;
1426                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1427                         rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1428                         dput(dentry);
1429                         if (rc)
1430                                 goto out_unlock;
1431                         isec->sid = sid;
1432                 }
1433                 break;
1434         }
1435
1436         isec->initialized = 1;
1437
1438 out_unlock:
1439         mutex_unlock(&isec->lock);
1440 out:
1441         if (isec->sclass == SECCLASS_FILE)
1442                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1443         return rc;
1444 }
1445
1446 /* Convert a Linux signal to an access vector. */
1447 static inline u32 signal_to_av(int sig)
1448 {
1449         u32 perm = 0;
1450
1451         switch (sig) {
1452         case SIGCHLD:
1453                 /* Commonly granted from child to parent. */
1454                 perm = PROCESS__SIGCHLD;
1455                 break;
1456         case SIGKILL:
1457                 /* Cannot be caught or ignored */
1458                 perm = PROCESS__SIGKILL;
1459                 break;
1460         case SIGSTOP:
1461                 /* Cannot be caught or ignored */
1462                 perm = PROCESS__SIGSTOP;
1463                 break;
1464         default:
1465                 /* All other signals. */
1466                 perm = PROCESS__SIGNAL;
1467                 break;
1468         }
1469
1470         return perm;
1471 }
1472
1473 /*
1474  * Check permission between a pair of credentials
1475  * fork check, ptrace check, etc.
1476  */
1477 static int cred_has_perm(const struct cred *actor,
1478                          const struct cred *target,
1479                          u32 perms)
1480 {
1481         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1482
1483         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1484 }
1485
1486 /*
1487  * Check permission between a pair of tasks, e.g. signal checks,
1488  * fork check, ptrace check, etc.
1489  * tsk1 is the actor and tsk2 is the target
1490  * - this uses the default subjective creds of tsk1
1491  */
1492 static int task_has_perm(const struct task_struct *tsk1,
1493                          const struct task_struct *tsk2,
1494                          u32 perms)
1495 {
1496         const struct task_security_struct *__tsec1, *__tsec2;
1497         u32 sid1, sid2;
1498
1499         rcu_read_lock();
1500         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1501         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1502         rcu_read_unlock();
1503         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1504 }
1505
1506 /*
1507  * Check permission between current and another task, e.g. signal checks,
1508  * fork check, ptrace check, etc.
1509  * current is the actor and tsk2 is the target
1510  * - this uses current's subjective creds
1511  */
1512 static int current_has_perm(const struct task_struct *tsk,
1513                             u32 perms)
1514 {
1515         u32 sid, tsid;
1516
1517         sid = current_sid();
1518         tsid = task_sid(tsk);
1519         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1520 }
1521
1522 #if CAP_LAST_CAP > 63
1523 #error Fix SELinux to handle capabilities > 63.
1524 #endif
1525
1526 /* Check whether a task is allowed to use a capability. */
1527 static int cred_has_capability(const struct cred *cred,
1528                                int cap, int audit)
1529 {
1530         struct common_audit_data ad;
1531         struct av_decision avd;
1532         u16 sclass;
1533         u32 sid = cred_sid(cred);
1534         u32 av = CAP_TO_MASK(cap);
1535         int rc;
1536
1537         ad.type = LSM_AUDIT_DATA_CAP;
1538         ad.u.cap = cap;
1539
1540         switch (CAP_TO_INDEX(cap)) {
1541         case 0:
1542                 sclass = SECCLASS_CAPABILITY;
1543                 break;
1544         case 1:
1545                 sclass = SECCLASS_CAPABILITY2;
1546                 break;
1547         default:
1548                 printk(KERN_ERR
1549                        "SELinux:  out of range capability %d\n", cap);
1550                 BUG();
1551                 return -EINVAL;
1552         }
1553
1554         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1555         if (audit == SECURITY_CAP_AUDIT) {
1556                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1557                 if (rc2)
1558                         return rc2;
1559         }
1560         return rc;
1561 }
1562
1563 /* Check whether a task is allowed to use a system operation. */
1564 static int task_has_system(struct task_struct *tsk,
1565                            u32 perms)
1566 {
1567         u32 sid = task_sid(tsk);
1568
1569         return avc_has_perm(sid, SECINITSID_KERNEL,
1570                             SECCLASS_SYSTEM, perms, NULL);
1571 }
1572
1573 /* Check whether a task has a particular permission to an inode.
1574    The 'adp' parameter is optional and allows other audit
1575    data to be passed (e.g. the dentry). */
1576 static int inode_has_perm(const struct cred *cred,
1577                           struct inode *inode,
1578                           u32 perms,
1579                           struct common_audit_data *adp)
1580 {
1581         struct inode_security_struct *isec;
1582         u32 sid;
1583
1584         validate_creds(cred);
1585
1586         if (unlikely(IS_PRIVATE(inode)))
1587                 return 0;
1588
1589         sid = cred_sid(cred);
1590         isec = inode->i_security;
1591
1592         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1593 }
1594
1595 /* Same as inode_has_perm, but pass explicit audit data containing
1596    the dentry to help the auditing code to more easily generate the
1597    pathname if needed. */
1598 static inline int dentry_has_perm(const struct cred *cred,
1599                                   struct dentry *dentry,
1600                                   u32 av)
1601 {
1602         struct inode *inode = dentry->d_inode;
1603         struct common_audit_data ad;
1604
1605         ad.type = LSM_AUDIT_DATA_DENTRY;
1606         ad.u.dentry = dentry;
1607         return inode_has_perm(cred, inode, av, &ad);
1608 }
1609
1610 /* Same as inode_has_perm, but pass explicit audit data containing
1611    the path to help the auditing code to more easily generate the
1612    pathname if needed. */
1613 static inline int path_has_perm(const struct cred *cred,
1614                                 struct path *path,
1615                                 u32 av)
1616 {
1617         struct inode *inode = path->dentry->d_inode;
1618         struct common_audit_data ad;
1619
1620         ad.type = LSM_AUDIT_DATA_PATH;
1621         ad.u.path = *path;
1622         return inode_has_perm(cred, inode, av, &ad);
1623 }
1624
1625 /* Same as path_has_perm, but uses the inode from the file struct. */
1626 static inline int file_path_has_perm(const struct cred *cred,
1627                                      struct file *file,
1628                                      u32 av)
1629 {
1630         struct common_audit_data ad;
1631
1632         ad.type = LSM_AUDIT_DATA_PATH;
1633         ad.u.path = file->f_path;
1634         return inode_has_perm(cred, file_inode(file), av, &ad);
1635 }
1636
1637 /* Check whether a task can use an open file descriptor to
1638    access an inode in a given way.  Check access to the
1639    descriptor itself, and then use dentry_has_perm to
1640    check a particular permission to the file.
1641    Access to the descriptor is implicitly granted if it
1642    has the same SID as the process.  If av is zero, then
1643    access to the file is not checked, e.g. for cases
1644    where only the descriptor is affected like seek. */
1645 static int file_has_perm(const struct cred *cred,
1646                          struct file *file,
1647                          u32 av)
1648 {
1649         struct file_security_struct *fsec = file->f_security;
1650         struct inode *inode = file_inode(file);
1651         struct common_audit_data ad;
1652         u32 sid = cred_sid(cred);
1653         int rc;
1654
1655         ad.type = LSM_AUDIT_DATA_PATH;
1656         ad.u.path = file->f_path;
1657
1658         if (sid != fsec->sid) {
1659                 rc = avc_has_perm(sid, fsec->sid,
1660                                   SECCLASS_FD,
1661                                   FD__USE,
1662                                   &ad);
1663                 if (rc)
1664                         goto out;
1665         }
1666
1667         /* av is zero if only checking access to the descriptor. */
1668         rc = 0;
1669         if (av)
1670                 rc = inode_has_perm(cred, inode, av, &ad);
1671
1672 out:
1673         return rc;
1674 }
1675
1676 /* Check whether a task can create a file. */
1677 static int may_create(struct inode *dir,
1678                       struct dentry *dentry,
1679                       u16 tclass)
1680 {
1681         const struct task_security_struct *tsec = current_security();
1682         struct inode_security_struct *dsec;
1683         struct superblock_security_struct *sbsec;
1684         u32 sid, newsid;
1685         struct common_audit_data ad;
1686         int rc;
1687
1688         dsec = dir->i_security;
1689         sbsec = dir->i_sb->s_security;
1690
1691         sid = tsec->sid;
1692         newsid = tsec->create_sid;
1693
1694         ad.type = LSM_AUDIT_DATA_DENTRY;
1695         ad.u.dentry = dentry;
1696
1697         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1698                           DIR__ADD_NAME | DIR__SEARCH,
1699                           &ad);
1700         if (rc)
1701                 return rc;
1702
1703         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1704                 rc = security_transition_sid(sid, dsec->sid, tclass,
1705                                              &dentry->d_name, &newsid);
1706                 if (rc)
1707                         return rc;
1708         }
1709
1710         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1711         if (rc)
1712                 return rc;
1713
1714         return avc_has_perm(newsid, sbsec->sid,
1715                             SECCLASS_FILESYSTEM,
1716                             FILESYSTEM__ASSOCIATE, &ad);
1717 }
1718
1719 /* Check whether a task can create a key. */
1720 static int may_create_key(u32 ksid,
1721                           struct task_struct *ctx)
1722 {
1723         u32 sid = task_sid(ctx);
1724
1725         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1726 }
1727
1728 #define MAY_LINK        0
1729 #define MAY_UNLINK      1
1730 #define MAY_RMDIR       2
1731
1732 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1733 static int may_link(struct inode *dir,
1734                     struct dentry *dentry,
1735                     int kind)
1736
1737 {
1738         struct inode_security_struct *dsec, *isec;
1739         struct common_audit_data ad;
1740         u32 sid = current_sid();
1741         u32 av;
1742         int rc;
1743
1744         dsec = dir->i_security;
1745         isec = dentry->d_inode->i_security;
1746
1747         ad.type = LSM_AUDIT_DATA_DENTRY;
1748         ad.u.dentry = dentry;
1749
1750         av = DIR__SEARCH;
1751         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1752         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1753         if (rc)
1754                 return rc;
1755
1756         switch (kind) {
1757         case MAY_LINK:
1758                 av = FILE__LINK;
1759                 break;
1760         case MAY_UNLINK:
1761                 av = FILE__UNLINK;
1762                 break;
1763         case MAY_RMDIR:
1764                 av = DIR__RMDIR;
1765                 break;
1766         default:
1767                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1768                         __func__, kind);
1769                 return 0;
1770         }
1771
1772         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1773         return rc;
1774 }
1775
1776 static inline int may_rename(struct inode *old_dir,
1777                              struct dentry *old_dentry,
1778                              struct inode *new_dir,
1779                              struct dentry *new_dentry)
1780 {
1781         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1782         struct common_audit_data ad;
1783         u32 sid = current_sid();
1784         u32 av;
1785         int old_is_dir, new_is_dir;
1786         int rc;
1787
1788         old_dsec = old_dir->i_security;
1789         old_isec = old_dentry->d_inode->i_security;
1790         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1791         new_dsec = new_dir->i_security;
1792
1793         ad.type = LSM_AUDIT_DATA_DENTRY;
1794
1795         ad.u.dentry = old_dentry;
1796         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1797                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1798         if (rc)
1799                 return rc;
1800         rc = avc_has_perm(sid, old_isec->sid,
1801                           old_isec->sclass, FILE__RENAME, &ad);
1802         if (rc)
1803                 return rc;
1804         if (old_is_dir && new_dir != old_dir) {
1805                 rc = avc_has_perm(sid, old_isec->sid,
1806                                   old_isec->sclass, DIR__REPARENT, &ad);
1807                 if (rc)
1808                         return rc;
1809         }
1810
1811         ad.u.dentry = new_dentry;
1812         av = DIR__ADD_NAME | DIR__SEARCH;
1813         if (new_dentry->d_inode)
1814                 av |= DIR__REMOVE_NAME;
1815         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1816         if (rc)
1817                 return rc;
1818         if (new_dentry->d_inode) {
1819                 new_isec = new_dentry->d_inode->i_security;
1820                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1821                 rc = avc_has_perm(sid, new_isec->sid,
1822                                   new_isec->sclass,
1823                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1824                 if (rc)
1825                         return rc;
1826         }
1827
1828         return 0;
1829 }
1830
1831 /* Check whether a task can perform a filesystem operation. */
1832 static int superblock_has_perm(const struct cred *cred,
1833                                struct super_block *sb,
1834                                u32 perms,
1835                                struct common_audit_data *ad)
1836 {
1837         struct superblock_security_struct *sbsec;
1838         u32 sid = cred_sid(cred);
1839
1840         sbsec = sb->s_security;
1841         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1842 }
1843
1844 /* Convert a Linux mode and permission mask to an access vector. */
1845 static inline u32 file_mask_to_av(int mode, int mask)
1846 {
1847         u32 av = 0;
1848
1849         if (!S_ISDIR(mode)) {
1850                 if (mask & MAY_EXEC)
1851                         av |= FILE__EXECUTE;
1852                 if (mask & MAY_READ)
1853                         av |= FILE__READ;
1854
1855                 if (mask & MAY_APPEND)
1856                         av |= FILE__APPEND;
1857                 else if (mask & MAY_WRITE)
1858                         av |= FILE__WRITE;
1859
1860         } else {
1861                 if (mask & MAY_EXEC)
1862                         av |= DIR__SEARCH;
1863                 if (mask & MAY_WRITE)
1864                         av |= DIR__WRITE;
1865                 if (mask & MAY_READ)
1866                         av |= DIR__READ;
1867         }
1868
1869         return av;
1870 }
1871
1872 /* Convert a Linux file to an access vector. */
1873 static inline u32 file_to_av(struct file *file)
1874 {
1875         u32 av = 0;
1876
1877         if (file->f_mode & FMODE_READ)
1878                 av |= FILE__READ;
1879         if (file->f_mode & FMODE_WRITE) {
1880                 if (file->f_flags & O_APPEND)
1881                         av |= FILE__APPEND;
1882                 else
1883                         av |= FILE__WRITE;
1884         }
1885         if (!av) {
1886                 /*
1887                  * Special file opened with flags 3 for ioctl-only use.
1888                  */
1889                 av = FILE__IOCTL;
1890         }
1891
1892         return av;
1893 }
1894
1895 /*
1896  * Convert a file to an access vector and include the correct open
1897  * open permission.
1898  */
1899 static inline u32 open_file_to_av(struct file *file)
1900 {
1901         u32 av = file_to_av(file);
1902
1903         if (selinux_policycap_openperm)
1904                 av |= FILE__OPEN;
1905
1906         return av;
1907 }
1908
1909 /* Hook functions begin here. */
1910
1911 static int selinux_ptrace_access_check(struct task_struct *child,
1912                                      unsigned int mode)
1913 {
1914         int rc;
1915
1916         rc = cap_ptrace_access_check(child, mode);
1917         if (rc)
1918                 return rc;
1919
1920         if (mode & PTRACE_MODE_READ) {
1921                 u32 sid = current_sid();
1922                 u32 csid = task_sid(child);
1923                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1924         }
1925
1926         return current_has_perm(child, PROCESS__PTRACE);
1927 }
1928
1929 static int selinux_ptrace_traceme(struct task_struct *parent)
1930 {
1931         int rc;
1932
1933         rc = cap_ptrace_traceme(parent);
1934         if (rc)
1935                 return rc;
1936
1937         return task_has_perm(parent, current, PROCESS__PTRACE);
1938 }
1939
1940 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1941                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1942 {
1943         int error;
1944
1945         error = current_has_perm(target, PROCESS__GETCAP);
1946         if (error)
1947                 return error;
1948
1949         return cap_capget(target, effective, inheritable, permitted);
1950 }
1951
1952 static int selinux_capset(struct cred *new, const struct cred *old,
1953                           const kernel_cap_t *effective,
1954                           const kernel_cap_t *inheritable,
1955                           const kernel_cap_t *permitted)
1956 {
1957         int error;
1958
1959         error = cap_capset(new, old,
1960                                       effective, inheritable, permitted);
1961         if (error)
1962                 return error;
1963
1964         return cred_has_perm(old, new, PROCESS__SETCAP);
1965 }
1966
1967 /*
1968  * (This comment used to live with the selinux_task_setuid hook,
1969  * which was removed).
1970  *
1971  * Since setuid only affects the current process, and since the SELinux
1972  * controls are not based on the Linux identity attributes, SELinux does not
1973  * need to control this operation.  However, SELinux does control the use of
1974  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1975  */
1976
1977 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1978                            int cap, int audit)
1979 {
1980         int rc;
1981
1982         rc = cap_capable(cred, ns, cap, audit);
1983         if (rc)
1984                 return rc;
1985
1986         return cred_has_capability(cred, cap, audit);
1987 }
1988
1989 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1990 {
1991         const struct cred *cred = current_cred();
1992         int rc = 0;
1993
1994         if (!sb)
1995                 return 0;
1996
1997         switch (cmds) {
1998         case Q_SYNC:
1999         case Q_QUOTAON:
2000         case Q_QUOTAOFF:
2001         case Q_SETINFO:
2002         case Q_SETQUOTA:
2003                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2004                 break;
2005         case Q_GETFMT:
2006         case Q_GETINFO:
2007         case Q_GETQUOTA:
2008                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2009                 break;
2010         default:
2011                 rc = 0;  /* let the kernel handle invalid cmds */
2012                 break;
2013         }
2014         return rc;
2015 }
2016
2017 static int selinux_quota_on(struct dentry *dentry)
2018 {
2019         const struct cred *cred = current_cred();
2020
2021         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2022 }
2023
2024 static int selinux_syslog(int type)
2025 {
2026         int rc;
2027
2028         switch (type) {
2029         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2030         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2031                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2032                 break;
2033         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2034         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2035         /* Set level of messages printed to console */
2036         case SYSLOG_ACTION_CONSOLE_LEVEL:
2037                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2038                 break;
2039         case SYSLOG_ACTION_CLOSE:       /* Close log */
2040         case SYSLOG_ACTION_OPEN:        /* Open log */
2041         case SYSLOG_ACTION_READ:        /* Read from log */
2042         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2043         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2044         default:
2045                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2046                 break;
2047         }
2048         return rc;
2049 }
2050
2051 /*
2052  * Check that a process has enough memory to allocate a new virtual
2053  * mapping. 0 means there is enough memory for the allocation to
2054  * succeed and -ENOMEM implies there is not.
2055  *
2056  * Do not audit the selinux permission check, as this is applied to all
2057  * processes that allocate mappings.
2058  */
2059 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2060 {
2061         int rc, cap_sys_admin = 0;
2062
2063         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2064                              SECURITY_CAP_NOAUDIT);
2065         if (rc == 0)
2066                 cap_sys_admin = 1;
2067
2068         return __vm_enough_memory(mm, pages, cap_sys_admin);
2069 }
2070
2071 /* binprm security operations */
2072
2073 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2074 {
2075         const struct task_security_struct *old_tsec;
2076         struct task_security_struct *new_tsec;
2077         struct inode_security_struct *isec;
2078         struct common_audit_data ad;
2079         struct inode *inode = file_inode(bprm->file);
2080         int rc;
2081
2082         rc = cap_bprm_set_creds(bprm);
2083         if (rc)
2084                 return rc;
2085
2086         /* SELinux context only depends on initial program or script and not
2087          * the script interpreter */
2088         if (bprm->cred_prepared)
2089                 return 0;
2090
2091         old_tsec = current_security();
2092         new_tsec = bprm->cred->security;
2093         isec = inode->i_security;
2094
2095         /* Default to the current task SID. */
2096         new_tsec->sid = old_tsec->sid;
2097         new_tsec->osid = old_tsec->sid;
2098
2099         /* Reset fs, key, and sock SIDs on execve. */
2100         new_tsec->create_sid = 0;
2101         new_tsec->keycreate_sid = 0;
2102         new_tsec->sockcreate_sid = 0;
2103
2104         if (old_tsec->exec_sid) {
2105                 new_tsec->sid = old_tsec->exec_sid;
2106                 /* Reset exec SID on execve. */
2107                 new_tsec->exec_sid = 0;
2108
2109                 /*
2110                  * Minimize confusion: if no_new_privs and a transition is
2111                  * explicitly requested, then fail the exec.
2112                  */
2113                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2114                         return -EPERM;
2115         } else {
2116                 /* Check for a default transition on this program. */
2117                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2118                                              SECCLASS_PROCESS, NULL,
2119                                              &new_tsec->sid);
2120                 if (rc)
2121                         return rc;
2122         }
2123
2124         ad.type = LSM_AUDIT_DATA_PATH;
2125         ad.u.path = bprm->file->f_path;
2126
2127         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2128             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2129                 new_tsec->sid = old_tsec->sid;
2130
2131         if (new_tsec->sid == old_tsec->sid) {
2132                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2133                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2134                 if (rc)
2135                         return rc;
2136         } else {
2137                 /* Check permissions for the transition. */
2138                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2139                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2140                 if (rc)
2141                         return rc;
2142
2143                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2144                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2145                 if (rc)
2146                         return rc;
2147
2148                 /* Check for shared state */
2149                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2150                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2151                                           SECCLASS_PROCESS, PROCESS__SHARE,
2152                                           NULL);
2153                         if (rc)
2154                                 return -EPERM;
2155                 }
2156
2157                 /* Make sure that anyone attempting to ptrace over a task that
2158                  * changes its SID has the appropriate permit */
2159                 if (bprm->unsafe &
2160                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2161                         struct task_struct *tracer;
2162                         struct task_security_struct *sec;
2163                         u32 ptsid = 0;
2164
2165                         rcu_read_lock();
2166                         tracer = ptrace_parent(current);
2167                         if (likely(tracer != NULL)) {
2168                                 sec = __task_cred(tracer)->security;
2169                                 ptsid = sec->sid;
2170                         }
2171                         rcu_read_unlock();
2172
2173                         if (ptsid != 0) {
2174                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2175                                                   SECCLASS_PROCESS,
2176                                                   PROCESS__PTRACE, NULL);
2177                                 if (rc)
2178                                         return -EPERM;
2179                         }
2180                 }
2181
2182                 /* Clear any possibly unsafe personality bits on exec: */
2183                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2184         }
2185
2186         return 0;
2187 }
2188
2189 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2190 {
2191         const struct task_security_struct *tsec = current_security();
2192         u32 sid, osid;
2193         int atsecure = 0;
2194
2195         sid = tsec->sid;
2196         osid = tsec->osid;
2197
2198         if (osid != sid) {
2199                 /* Enable secure mode for SIDs transitions unless
2200                    the noatsecure permission is granted between
2201                    the two SIDs, i.e. ahp returns 0. */
2202                 atsecure = avc_has_perm(osid, sid,
2203                                         SECCLASS_PROCESS,
2204                                         PROCESS__NOATSECURE, NULL);
2205         }
2206
2207         return (atsecure || cap_bprm_secureexec(bprm));
2208 }
2209
2210 static int match_file(const void *p, struct file *file, unsigned fd)
2211 {
2212         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2213 }
2214
2215 /* Derived from fs/exec.c:flush_old_files. */
2216 static inline void flush_unauthorized_files(const struct cred *cred,
2217                                             struct files_struct *files)
2218 {
2219         struct file *file, *devnull = NULL;
2220         struct tty_struct *tty;
2221         int drop_tty = 0;
2222         unsigned n;
2223
2224         tty = get_current_tty();
2225         if (tty) {
2226                 spin_lock(&tty_files_lock);
2227                 if (!list_empty(&tty->tty_files)) {
2228                         struct tty_file_private *file_priv;
2229
2230                         /* Revalidate access to controlling tty.
2231                            Use file_path_has_perm on the tty path directly
2232                            rather than using file_has_perm, as this particular
2233                            open file may belong to another process and we are
2234                            only interested in the inode-based check here. */
2235                         file_priv = list_first_entry(&tty->tty_files,
2236                                                 struct tty_file_private, list);
2237                         file = file_priv->file;
2238                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2239                                 drop_tty = 1;
2240                 }
2241                 spin_unlock(&tty_files_lock);
2242                 tty_kref_put(tty);
2243         }
2244         /* Reset controlling tty. */
2245         if (drop_tty)
2246                 no_tty();
2247
2248         /* Revalidate access to inherited open files. */
2249         n = iterate_fd(files, 0, match_file, cred);
2250         if (!n) /* none found? */
2251                 return;
2252
2253         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2254         if (IS_ERR(devnull))
2255                 devnull = NULL;
2256         /* replace all the matching ones with this */
2257         do {
2258                 replace_fd(n - 1, devnull, 0);
2259         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2260         if (devnull)
2261                 fput(devnull);
2262 }
2263
2264 /*
2265  * Prepare a process for imminent new credential changes due to exec
2266  */
2267 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2268 {
2269         struct task_security_struct *new_tsec;
2270         struct rlimit *rlim, *initrlim;
2271         int rc, i;
2272
2273         new_tsec = bprm->cred->security;
2274         if (new_tsec->sid == new_tsec->osid)
2275                 return;
2276
2277         /* Close files for which the new task SID is not authorized. */
2278         flush_unauthorized_files(bprm->cred, current->files);
2279
2280         /* Always clear parent death signal on SID transitions. */
2281         current->pdeath_signal = 0;
2282
2283         /* Check whether the new SID can inherit resource limits from the old
2284          * SID.  If not, reset all soft limits to the lower of the current
2285          * task's hard limit and the init task's soft limit.
2286          *
2287          * Note that the setting of hard limits (even to lower them) can be
2288          * controlled by the setrlimit check.  The inclusion of the init task's
2289          * soft limit into the computation is to avoid resetting soft limits
2290          * higher than the default soft limit for cases where the default is
2291          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2292          */
2293         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2294                           PROCESS__RLIMITINH, NULL);
2295         if (rc) {
2296                 /* protect against do_prlimit() */
2297                 task_lock(current);
2298                 for (i = 0; i < RLIM_NLIMITS; i++) {
2299                         rlim = current->signal->rlim + i;
2300                         initrlim = init_task.signal->rlim + i;
2301                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2302                 }
2303                 task_unlock(current);
2304                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2305         }
2306 }
2307
2308 /*
2309  * Clean up the process immediately after the installation of new credentials
2310  * due to exec
2311  */
2312 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2313 {
2314         const struct task_security_struct *tsec = current_security();
2315         struct itimerval itimer;
2316         u32 osid, sid;
2317         int rc, i;
2318
2319         osid = tsec->osid;
2320         sid = tsec->sid;
2321
2322         if (sid == osid)
2323                 return;
2324
2325         /* Check whether the new SID can inherit signal state from the old SID.
2326          * If not, clear itimers to avoid subsequent signal generation and
2327          * flush and unblock signals.
2328          *
2329          * This must occur _after_ the task SID has been updated so that any
2330          * kill done after the flush will be checked against the new SID.
2331          */
2332         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2333         if (rc) {
2334                 memset(&itimer, 0, sizeof itimer);
2335                 for (i = 0; i < 3; i++)
2336                         do_setitimer(i, &itimer, NULL);
2337                 spin_lock_irq(&current->sighand->siglock);
2338                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2339                         __flush_signals(current);
2340                         flush_signal_handlers(current, 1);
2341                         sigemptyset(&current->blocked);
2342                 }
2343                 spin_unlock_irq(&current->sighand->siglock);
2344         }
2345
2346         /* Wake up the parent if it is waiting so that it can recheck
2347          * wait permission to the new task SID. */
2348         read_lock(&tasklist_lock);
2349         __wake_up_parent(current, current->real_parent);
2350         read_unlock(&tasklist_lock);
2351 }
2352
2353 /* superblock security operations */
2354
2355 static int selinux_sb_alloc_security(struct super_block *sb)
2356 {
2357         return superblock_alloc_security(sb);
2358 }
2359
2360 static void selinux_sb_free_security(struct super_block *sb)
2361 {
2362         superblock_free_security(sb);
2363 }
2364
2365 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2366 {
2367         if (plen > olen)
2368                 return 0;
2369
2370         return !memcmp(prefix, option, plen);
2371 }
2372
2373 static inline int selinux_option(char *option, int len)
2374 {
2375         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2376                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2377                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2378                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2379                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2380 }
2381
2382 static inline void take_option(char **to, char *from, int *first, int len)
2383 {
2384         if (!*first) {
2385                 **to = ',';
2386                 *to += 1;
2387         } else
2388                 *first = 0;
2389         memcpy(*to, from, len);
2390         *to += len;
2391 }
2392
2393 static inline void take_selinux_option(char **to, char *from, int *first,
2394                                        int len)
2395 {
2396         int current_size = 0;
2397
2398         if (!*first) {
2399                 **to = '|';
2400                 *to += 1;
2401         } else
2402                 *first = 0;
2403
2404         while (current_size < len) {
2405                 if (*from != '"') {
2406                         **to = *from;
2407                         *to += 1;
2408                 }
2409                 from += 1;
2410                 current_size += 1;
2411         }
2412 }
2413
2414 static int selinux_sb_copy_data(char *orig, char *copy)
2415 {
2416         int fnosec, fsec, rc = 0;
2417         char *in_save, *in_curr, *in_end;
2418         char *sec_curr, *nosec_save, *nosec;
2419         int open_quote = 0;
2420
2421         in_curr = orig;
2422         sec_curr = copy;
2423
2424         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2425         if (!nosec) {
2426                 rc = -ENOMEM;
2427                 goto out;
2428         }
2429
2430         nosec_save = nosec;
2431         fnosec = fsec = 1;
2432         in_save = in_end = orig;
2433
2434         do {
2435                 if (*in_end == '"')
2436                         open_quote = !open_quote;
2437                 if ((*in_end == ',' && open_quote == 0) ||
2438                                 *in_end == '\0') {
2439                         int len = in_end - in_curr;
2440
2441                         if (selinux_option(in_curr, len))
2442                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2443                         else
2444                                 take_option(&nosec, in_curr, &fnosec, len);
2445
2446                         in_curr = in_end + 1;
2447                 }
2448         } while (*in_end++);
2449
2450         strcpy(in_save, nosec_save);
2451         free_page((unsigned long)nosec_save);
2452 out:
2453         return rc;
2454 }
2455
2456 static int selinux_sb_remount(struct super_block *sb, void *data)
2457 {
2458         int rc, i, *flags;
2459         struct security_mnt_opts opts;
2460         char *secdata, **mount_options;
2461         struct superblock_security_struct *sbsec = sb->s_security;
2462
2463         if (!(sbsec->flags & SE_SBINITIALIZED))
2464                 return 0;
2465
2466         if (!data)
2467                 return 0;
2468
2469         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2470                 return 0;
2471
2472         security_init_mnt_opts(&opts);
2473         secdata = alloc_secdata();
2474         if (!secdata)
2475                 return -ENOMEM;
2476         rc = selinux_sb_copy_data(data, secdata);
2477         if (rc)
2478                 goto out_free_secdata;
2479
2480         rc = selinux_parse_opts_str(secdata, &opts);
2481         if (rc)
2482                 goto out_free_secdata;
2483
2484         mount_options = opts.mnt_opts;
2485         flags = opts.mnt_opts_flags;
2486
2487         for (i = 0; i < opts.num_mnt_opts; i++) {
2488                 u32 sid;
2489                 size_t len;
2490
2491                 if (flags[i] == SBLABEL_MNT)
2492                         continue;
2493                 len = strlen(mount_options[i]);
2494                 rc = security_context_to_sid(mount_options[i], len, &sid);
2495                 if (rc) {
2496                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2497                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2498                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2499                         goto out_free_opts;
2500                 }
2501                 rc = -EINVAL;
2502                 switch (flags[i]) {
2503                 case FSCONTEXT_MNT:
2504                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2505                                 goto out_bad_option;
2506                         break;
2507                 case CONTEXT_MNT:
2508                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2509                                 goto out_bad_option;
2510                         break;
2511                 case ROOTCONTEXT_MNT: {
2512                         struct inode_security_struct *root_isec;
2513                         root_isec = sb->s_root->d_inode->i_security;
2514
2515                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2516                                 goto out_bad_option;
2517                         break;
2518                 }
2519                 case DEFCONTEXT_MNT:
2520                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2521                                 goto out_bad_option;
2522                         break;
2523                 default:
2524                         goto out_free_opts;
2525                 }
2526         }
2527
2528         rc = 0;
2529 out_free_opts:
2530         security_free_mnt_opts(&opts);
2531 out_free_secdata:
2532         free_secdata(secdata);
2533         return rc;
2534 out_bad_option:
2535         printk(KERN_WARNING "SELinux: unable to change security options "
2536                "during remount (dev %s, type=%s)\n", sb->s_id,
2537                sb->s_type->name);
2538         goto out_free_opts;
2539 }
2540
2541 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2542 {
2543         const struct cred *cred = current_cred();
2544         struct common_audit_data ad;
2545         int rc;
2546
2547         rc = superblock_doinit(sb, data);
2548         if (rc)
2549                 return rc;
2550
2551         /* Allow all mounts performed by the kernel */
2552         if (flags & MS_KERNMOUNT)
2553                 return 0;
2554
2555         ad.type = LSM_AUDIT_DATA_DENTRY;
2556         ad.u.dentry = sb->s_root;
2557         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2558 }
2559
2560 static int selinux_sb_statfs(struct dentry *dentry)
2561 {
2562         const struct cred *cred = current_cred();
2563         struct common_audit_data ad;
2564
2565         ad.type = LSM_AUDIT_DATA_DENTRY;
2566         ad.u.dentry = dentry->d_sb->s_root;
2567         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2568 }
2569
2570 static int selinux_mount(const char *dev_name,
2571                          struct path *path,
2572                          const char *type,
2573                          unsigned long flags,
2574                          void *data)
2575 {
2576         const struct cred *cred = current_cred();
2577
2578         if (flags & MS_REMOUNT)
2579                 return superblock_has_perm(cred, path->dentry->d_sb,
2580                                            FILESYSTEM__REMOUNT, NULL);
2581         else
2582                 return path_has_perm(cred, path, FILE__MOUNTON);
2583 }
2584
2585 static int selinux_umount(struct vfsmount *mnt, int flags)
2586 {
2587         const struct cred *cred = current_cred();
2588
2589         return superblock_has_perm(cred, mnt->mnt_sb,
2590                                    FILESYSTEM__UNMOUNT, NULL);
2591 }
2592
2593 /* inode security operations */
2594
2595 static int selinux_inode_alloc_security(struct inode *inode)
2596 {
2597         return inode_alloc_security(inode);
2598 }
2599
2600 static void selinux_inode_free_security(struct inode *inode)
2601 {
2602         inode_free_security(inode);
2603 }
2604
2605 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2606                                         struct qstr *name, void **ctx,
2607                                         u32 *ctxlen)
2608 {
2609         const struct cred *cred = current_cred();
2610         struct task_security_struct *tsec;
2611         struct inode_security_struct *dsec;
2612         struct superblock_security_struct *sbsec;
2613         struct inode *dir = dentry->d_parent->d_inode;
2614         u32 newsid;
2615         int rc;
2616
2617         tsec = cred->security;
2618         dsec = dir->i_security;
2619         sbsec = dir->i_sb->s_security;
2620
2621         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2622                 newsid = tsec->create_sid;
2623         } else {
2624                 rc = security_transition_sid(tsec->sid, dsec->sid,
2625                                              inode_mode_to_security_class(mode),
2626                                              name,
2627                                              &newsid);
2628                 if (rc) {
2629                         printk(KERN_WARNING
2630                                 "%s: security_transition_sid failed, rc=%d\n",
2631                                __func__, -rc);
2632                         return rc;
2633                 }
2634         }
2635
2636         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2637 }
2638
2639 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2640                                        const struct qstr *qstr,
2641                                        const char **name,
2642                                        void **value, size_t *len)
2643 {
2644         const struct task_security_struct *tsec = current_security();
2645         struct inode_security_struct *dsec;
2646         struct superblock_security_struct *sbsec;
2647         u32 sid, newsid, clen;
2648         int rc;
2649         char *context;
2650
2651         dsec = dir->i_security;
2652         sbsec = dir->i_sb->s_security;
2653
2654         sid = tsec->sid;
2655         newsid = tsec->create_sid;
2656
2657         if ((sbsec->flags & SE_SBINITIALIZED) &&
2658             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2659                 newsid = sbsec->mntpoint_sid;
2660         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2661                 rc = security_transition_sid(sid, dsec->sid,
2662                                              inode_mode_to_security_class(inode->i_mode),
2663                                              qstr, &newsid);
2664                 if (rc) {
2665                         printk(KERN_WARNING "%s:  "
2666                                "security_transition_sid failed, rc=%d (dev=%s "
2667                                "ino=%ld)\n",
2668                                __func__,
2669                                -rc, inode->i_sb->s_id, inode->i_ino);
2670                         return rc;
2671                 }
2672         }
2673
2674         /* Possibly defer initialization to selinux_complete_init. */
2675         if (sbsec->flags & SE_SBINITIALIZED) {
2676                 struct inode_security_struct *isec = inode->i_security;
2677                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2678                 isec->sid = newsid;
2679                 isec->initialized = 1;
2680         }
2681
2682         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2683                 return -EOPNOTSUPP;
2684
2685         if (name)
2686                 *name = XATTR_SELINUX_SUFFIX;
2687
2688         if (value && len) {
2689                 rc = security_sid_to_context_force(newsid, &context, &clen);
2690                 if (rc)
2691                         return rc;
2692                 *value = context;
2693                 *len = clen;
2694         }
2695
2696         return 0;
2697 }
2698
2699 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2700 {
2701         return may_create(dir, dentry, SECCLASS_FILE);
2702 }
2703
2704 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2705 {
2706         return may_link(dir, old_dentry, MAY_LINK);
2707 }
2708
2709 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2710 {
2711         return may_link(dir, dentry, MAY_UNLINK);
2712 }
2713
2714 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2715 {
2716         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2717 }
2718
2719 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2720 {
2721         return may_create(dir, dentry, SECCLASS_DIR);
2722 }
2723
2724 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2725 {
2726         return may_link(dir, dentry, MAY_RMDIR);
2727 }
2728
2729 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2730 {
2731         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2732 }
2733
2734 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2735                                 struct inode *new_inode, struct dentry *new_dentry)
2736 {
2737         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2738 }
2739
2740 static int selinux_inode_readlink(struct dentry *dentry)
2741 {
2742         const struct cred *cred = current_cred();
2743
2744         return dentry_has_perm(cred, dentry, FILE__READ);
2745 }
2746
2747 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2748 {
2749         const struct cred *cred = current_cred();
2750
2751         return dentry_has_perm(cred, dentry, FILE__READ);
2752 }
2753
2754 static noinline int audit_inode_permission(struct inode *inode,
2755                                            u32 perms, u32 audited, u32 denied,
2756                                            unsigned flags)
2757 {
2758         struct common_audit_data ad;
2759         struct inode_security_struct *isec = inode->i_security;
2760         int rc;
2761
2762         ad.type = LSM_AUDIT_DATA_INODE;
2763         ad.u.inode = inode;
2764
2765         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2766                             audited, denied, &ad, flags);
2767         if (rc)
2768                 return rc;
2769         return 0;
2770 }
2771
2772 static int selinux_inode_permission(struct inode *inode, int mask)
2773 {
2774         const struct cred *cred = current_cred();
2775         u32 perms;
2776         bool from_access;
2777         unsigned flags = mask & MAY_NOT_BLOCK;
2778         struct inode_security_struct *isec;
2779         u32 sid;
2780         struct av_decision avd;
2781         int rc, rc2;
2782         u32 audited, denied;
2783
2784         from_access = mask & MAY_ACCESS;
2785         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2786
2787         /* No permission to check.  Existence test. */
2788         if (!mask)
2789                 return 0;
2790
2791         validate_creds(cred);
2792
2793         if (unlikely(IS_PRIVATE(inode)))
2794                 return 0;
2795
2796         perms = file_mask_to_av(inode->i_mode, mask);
2797
2798         sid = cred_sid(cred);
2799         isec = inode->i_security;
2800
2801         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2802         audited = avc_audit_required(perms, &avd, rc,
2803                                      from_access ? FILE__AUDIT_ACCESS : 0,
2804                                      &denied);
2805         if (likely(!audited))
2806                 return rc;
2807
2808         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2809         if (rc2)
2810                 return rc2;
2811         return rc;
2812 }
2813
2814 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2815 {
2816         const struct cred *cred = current_cred();
2817         unsigned int ia_valid = iattr->ia_valid;
2818         __u32 av = FILE__WRITE;
2819
2820         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2821         if (ia_valid & ATTR_FORCE) {
2822                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2823                               ATTR_FORCE);
2824                 if (!ia_valid)
2825                         return 0;
2826         }
2827
2828         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2829                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2830                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2831
2832         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2833                 av |= FILE__OPEN;
2834
2835         return dentry_has_perm(cred, dentry, av);
2836 }
2837
2838 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2839 {
2840         const struct cred *cred = current_cred();
2841         struct path path;
2842
2843         path.dentry = dentry;
2844         path.mnt = mnt;
2845
2846         return path_has_perm(cred, &path, FILE__GETATTR);
2847 }
2848
2849 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2850 {
2851         const struct cred *cred = current_cred();
2852
2853         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2854                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2855                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2856                         if (!capable(CAP_SETFCAP))
2857                                 return -EPERM;
2858                 } else if (!capable(CAP_SYS_ADMIN)) {
2859                         /* A different attribute in the security namespace.
2860                            Restrict to administrator. */
2861                         return -EPERM;
2862                 }
2863         }
2864
2865         /* Not an attribute we recognize, so just check the
2866            ordinary setattr permission. */
2867         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2868 }
2869
2870 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2871                                   const void *value, size_t size, int flags)
2872 {
2873         struct inode *inode = dentry->d_inode;
2874         struct inode_security_struct *isec = inode->i_security;
2875         struct superblock_security_struct *sbsec;
2876         struct common_audit_data ad;
2877         u32 newsid, sid = current_sid();
2878         int rc = 0;
2879
2880         if (strcmp(name, XATTR_NAME_SELINUX))
2881                 return selinux_inode_setotherxattr(dentry, name);
2882
2883         sbsec = inode->i_sb->s_security;
2884         if (!(sbsec->flags & SBLABEL_MNT))
2885                 return -EOPNOTSUPP;
2886
2887         if (!inode_owner_or_capable(inode))
2888                 return -EPERM;
2889
2890         ad.type = LSM_AUDIT_DATA_DENTRY;
2891         ad.u.dentry = dentry;
2892
2893         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2894                           FILE__RELABELFROM, &ad);
2895         if (rc)
2896                 return rc;
2897
2898         rc = security_context_to_sid(value, size, &newsid);
2899         if (rc == -EINVAL) {
2900                 if (!capable(CAP_MAC_ADMIN)) {
2901                         struct audit_buffer *ab;
2902                         size_t audit_size;
2903                         const char *str;
2904
2905                         /* We strip a nul only if it is at the end, otherwise the
2906                          * context contains a nul and we should audit that */
2907                         if (value) {
2908                                 str = value;
2909                                 if (str[size - 1] == '\0')
2910                                         audit_size = size - 1;
2911                                 else
2912                                         audit_size = size;
2913                         } else {
2914                                 str = "";
2915                                 audit_size = 0;
2916                         }
2917                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2918                         audit_log_format(ab, "op=setxattr invalid_context=");
2919                         audit_log_n_untrustedstring(ab, value, audit_size);
2920                         audit_log_end(ab);
2921
2922                         return rc;
2923                 }
2924                 rc = security_context_to_sid_force(value, size, &newsid);
2925         }
2926         if (rc)
2927                 return rc;
2928
2929         rc = avc_has_perm(sid, newsid, isec->sclass,
2930                           FILE__RELABELTO, &ad);
2931         if (rc)
2932                 return rc;
2933
2934         rc = security_validate_transition(isec->sid, newsid, sid,
2935                                           isec->sclass);
2936         if (rc)
2937                 return rc;
2938
2939         return avc_has_perm(newsid,
2940                             sbsec->sid,
2941                             SECCLASS_FILESYSTEM,
2942                             FILESYSTEM__ASSOCIATE,
2943                             &ad);
2944 }
2945
2946 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2947                                         const void *value, size_t size,
2948                                         int flags)
2949 {
2950         struct inode *inode = dentry->d_inode;
2951         struct inode_security_struct *isec = inode->i_security;
2952         u32 newsid;
2953         int rc;
2954
2955         if (strcmp(name, XATTR_NAME_SELINUX)) {
2956                 /* Not an attribute we recognize, so nothing to do. */
2957                 return;
2958         }
2959
2960         rc = security_context_to_sid_force(value, size, &newsid);
2961         if (rc) {
2962                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2963                        "for (%s, %lu), rc=%d\n",
2964                        inode->i_sb->s_id, inode->i_ino, -rc);
2965                 return;
2966         }
2967
2968         isec->sclass = inode_mode_to_security_class(inode->i_mode);
2969         isec->sid = newsid;
2970         isec->initialized = 1;
2971
2972         return;
2973 }
2974
2975 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2976 {
2977         const struct cred *cred = current_cred();
2978
2979         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2980 }
2981
2982 static int selinux_inode_listxattr(struct dentry *dentry)
2983 {
2984         const struct cred *cred = current_cred();
2985
2986         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2987 }
2988
2989 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2990 {
2991         if (strcmp(name, XATTR_NAME_SELINUX))
2992                 return selinux_inode_setotherxattr(dentry, name);
2993
2994         /* No one is allowed to remove a SELinux security label.
2995            You can change the label, but all data must be labeled. */
2996         return -EACCES;
2997 }
2998
2999 /*
3000  * Copy the inode security context value to the user.
3001  *
3002  * Permission check is handled by selinux_inode_getxattr hook.
3003  */
3004 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3005 {
3006         u32 size;
3007         int error;
3008         char *context = NULL;
3009         struct inode_security_struct *isec = inode->i_security;
3010
3011         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3012                 return -EOPNOTSUPP;
3013
3014         /*
3015          * If the caller has CAP_MAC_ADMIN, then get the raw context
3016          * value even if it is not defined by current policy; otherwise,
3017          * use the in-core value under current policy.
3018          * Use the non-auditing forms of the permission checks since
3019          * getxattr may be called by unprivileged processes commonly
3020          * and lack of permission just means that we fall back to the
3021          * in-core context value, not a denial.
3022          */
3023         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3024                                 SECURITY_CAP_NOAUDIT);
3025         if (!error)
3026                 error = security_sid_to_context_force(isec->sid, &context,
3027                                                       &size);
3028         else
3029                 error = security_sid_to_context(isec->sid, &context, &size);
3030         if (error)
3031                 return error;
3032         error = size;
3033         if (alloc) {
3034                 *buffer = context;
3035                 goto out_nofree;
3036         }
3037         kfree(context);
3038 out_nofree:
3039         return error;
3040 }
3041
3042 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3043                                      const void *value, size_t size, int flags)
3044 {
3045         struct inode_security_struct *isec = inode->i_security;
3046         u32 newsid;
3047         int rc;
3048
3049         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3050                 return -EOPNOTSUPP;
3051
3052         if (!value || !size)
3053                 return -EACCES;
3054
3055         rc = security_context_to_sid((void *)value, size, &newsid);
3056         if (rc)
3057                 return rc;
3058
3059         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3060         isec->sid = newsid;
3061         isec->initialized = 1;
3062         return 0;
3063 }
3064
3065 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3066 {
3067         const int len = sizeof(XATTR_NAME_SELINUX);
3068         if (buffer && len <= buffer_size)
3069                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3070         return len;
3071 }
3072
3073 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3074 {
3075         struct inode_security_struct *isec = inode->i_security;
3076         *secid = isec->sid;
3077 }
3078
3079 /* file security operations */
3080
3081 static int selinux_revalidate_file_permission(struct file *file, int mask)
3082 {
3083         const struct cred *cred = current_cred();
3084         struct inode *inode = file_inode(file);
3085
3086         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3087         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3088                 mask |= MAY_APPEND;
3089
3090         return file_has_perm(cred, file,
3091                              file_mask_to_av(inode->i_mode, mask));
3092 }
3093
3094 static int selinux_file_permission(struct file *file, int mask)
3095 {
3096         struct inode *inode = file_inode(file);
3097         struct file_security_struct *fsec = file->f_security;
3098         struct inode_security_struct *isec = inode->i_security;
3099         u32 sid = current_sid();
3100
3101         if (!mask)
3102                 /* No permission to check.  Existence test. */
3103                 return 0;
3104
3105         if (sid == fsec->sid && fsec->isid == isec->sid &&
3106             fsec->pseqno == avc_policy_seqno())
3107                 /* No change since file_open check. */
3108                 return 0;
3109
3110         return selinux_revalidate_file_permission(file, mask);
3111 }
3112
3113 static int selinux_file_alloc_security(struct file *file)
3114 {
3115         return file_alloc_security(file);
3116 }
3117
3118 static void selinux_file_free_security(struct file *file)
3119 {
3120         file_free_security(file);
3121 }
3122
3123 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3124                               unsigned long arg)
3125 {
3126         const struct cred *cred = current_cred();
3127         int error = 0;
3128
3129         switch (cmd) {
3130         case FIONREAD:
3131         /* fall through */
3132         case FIBMAP:
3133         /* fall through */
3134         case FIGETBSZ:
3135         /* fall through */
3136         case FS_IOC_GETFLAGS:
3137         /* fall through */
3138         case FS_IOC_GETVERSION:
3139                 error = file_has_perm(cred, file, FILE__GETATTR);
3140                 break;
3141
3142         case FS_IOC_SETFLAGS:
3143         /* fall through */
3144         case FS_IOC_SETVERSION:
3145                 error = file_has_perm(cred, file, FILE__SETATTR);
3146                 break;
3147
3148         /* sys_ioctl() checks */
3149         case FIONBIO:
3150         /* fall through */
3151         case FIOASYNC:
3152                 error = file_has_perm(cred, file, 0);
3153                 break;
3154
3155         case KDSKBENT:
3156         case KDSKBSENT:
3157                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3158                                             SECURITY_CAP_AUDIT);
3159                 break;
3160
3161         /* default case assumes that the command will go
3162          * to the file's ioctl() function.
3163          */
3164         default:
3165                 error = file_has_perm(cred, file, FILE__IOCTL);
3166         }
3167         return error;
3168 }
3169
3170 static int default_noexec;
3171
3172 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3173 {
3174         const struct cred *cred = current_cred();
3175         int rc = 0;
3176
3177         if (default_noexec &&
3178             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3179                 /*
3180                  * We are making executable an anonymous mapping or a
3181                  * private file mapping that will also be writable.
3182                  * This has an additional check.
3183                  */
3184                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3185                 if (rc)
3186                         goto error;
3187         }
3188
3189         if (file) {
3190                 /* read access is always possible with a mapping */
3191                 u32 av = FILE__READ;
3192
3193                 /* write access only matters if the mapping is shared */
3194                 if (shared && (prot & PROT_WRITE))
3195                         av |= FILE__WRITE;
3196
3197                 if (prot & PROT_EXEC)
3198                         av |= FILE__EXECUTE;
3199
3200                 return file_has_perm(cred, file, av);
3201         }
3202
3203 error:
3204         return rc;
3205 }
3206
3207 static int selinux_mmap_addr(unsigned long addr)
3208 {
3209         int rc;
3210
3211         /* do DAC check on address space usage */
3212         rc = cap_mmap_addr(addr);
3213         if (rc)
3214                 return rc;
3215
3216         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3217                 u32 sid = current_sid();
3218                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3219                                   MEMPROTECT__MMAP_ZERO, NULL);
3220         }
3221
3222         return rc;
3223 }
3224
3225 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3226                              unsigned long prot, unsigned long flags)
3227 {
3228         if (selinux_checkreqprot)
3229                 prot = reqprot;
3230
3231         return file_map_prot_check(file, prot,
3232                                    (flags & MAP_TYPE) == MAP_SHARED);
3233 }
3234
3235 static int selinux_file_mprotect(struct vm_area_struct *vma,
3236                                  unsigned long reqprot,
3237                                  unsigned long prot)
3238 {
3239         const struct cred *cred = current_cred();
3240
3241         if (selinux_checkreqprot)
3242                 prot = reqprot;
3243
3244         if (default_noexec &&
3245             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3246                 int rc = 0;
3247                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3248                     vma->vm_end <= vma->vm_mm->brk) {
3249                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3250                 } else if (!vma->vm_file &&
3251                            vma->vm_start <= vma->vm_mm->start_stack &&
3252                            vma->vm_end >= vma->vm_mm->start_stack) {
3253                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3254                 } else if (vma->vm_file && vma->anon_vma) {
3255                         /*
3256                          * We are making executable a file mapping that has
3257                          * had some COW done. Since pages might have been
3258                          * written, check ability to execute the possibly
3259                          * modified content.  This typically should only
3260                          * occur for text relocations.
3261                          */
3262                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3263                 }
3264                 if (rc)
3265                         return rc;
3266         }
3267
3268         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3269 }
3270
3271 static int selinux_file_lock(struct file *file, unsigned int cmd)
3272 {
3273         const struct cred *cred = current_cred();
3274
3275         return file_has_perm(cred, file, FILE__LOCK);
3276 }
3277
3278 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3279                               unsigned long arg)
3280 {
3281         const struct cred *cred = current_cred();
3282         int err = 0;
3283
3284         switch (cmd) {
3285         case F_SETFL:
3286                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3287                         err = file_has_perm(cred, file, FILE__WRITE);
3288                         break;
3289                 }
3290                 /* fall through */
3291         case F_SETOWN:
3292         case F_SETSIG:
3293         case F_GETFL:
3294         case F_GETOWN:
3295         case F_GETSIG:
3296         case F_GETOWNER_UIDS:
3297                 /* Just check FD__USE permission */
3298                 err = file_has_perm(cred, file, 0);
3299                 break;
3300         case F_GETLK:
3301         case F_SETLK:
3302         case F_SETLKW:
3303 #if BITS_PER_LONG == 32
3304         case F_GETLK64:
3305         case F_SETLK64:
3306         case F_SETLKW64:
3307 #endif
3308                 err = file_has_perm(cred, file, FILE__LOCK);
3309                 break;
3310         }
3311
3312         return err;
3313 }
3314
3315 static int selinux_file_set_fowner(struct file *file)
3316 {
3317         struct file_security_struct *fsec;
3318
3319         fsec = file->f_security;
3320         fsec->fown_sid = current_sid();
3321
3322         return 0;
3323 }
3324
3325 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3326                                        struct fown_struct *fown, int signum)
3327 {
3328         struct file *file;
3329         u32 sid = task_sid(tsk);
3330         u32 perm;
3331         struct file_security_struct *fsec;
3332
3333         /* struct fown_struct is never outside the context of a struct file */
3334         file = container_of(fown, struct file, f_owner);
3335
3336         fsec = file->f_security;
3337
3338         if (!signum)
3339                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3340         else
3341                 perm = signal_to_av(signum);
3342
3343         return avc_has_perm(fsec->fown_sid, sid,
3344                             SECCLASS_PROCESS, perm, NULL);
3345 }
3346
3347 static int selinux_file_receive(struct file *file)
3348 {
3349         const struct cred *cred = current_cred();
3350
3351         return file_has_perm(cred, file, file_to_av(file));
3352 }
3353
3354 static int selinux_file_open(struct file *file, const struct cred *cred)
3355 {
3356         struct file_security_struct *fsec;
3357         struct inode_security_struct *isec;
3358
3359         fsec = file->f_security;
3360         isec = file_inode(file)->i_security;
3361         /*
3362          * Save inode label and policy sequence number
3363          * at open-time so that selinux_file_permission
3364          * can determine whether revalidation is necessary.
3365          * Task label is already saved in the file security
3366          * struct as its SID.
3367          */
3368         fsec->isid = isec->sid;
3369         fsec->pseqno = avc_policy_seqno();
3370         /*
3371          * Since the inode label or policy seqno may have changed
3372          * between the selinux_inode_permission check and the saving
3373          * of state above, recheck that access is still permitted.
3374          * Otherwise, access might never be revalidated against the
3375          * new inode label or new policy.
3376          * This check is not redundant - do not remove.
3377          */
3378         return file_path_has_perm(cred, file, open_file_to_av(file));
3379 }
3380
3381 /* task security operations */
3382
3383 static int selinux_task_create(unsigned long clone_flags)
3384 {
3385         return current_has_perm(current, PROCESS__FORK);
3386 }
3387
3388 /*
3389  * allocate the SELinux part of blank credentials
3390  */
3391 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3392 {
3393         struct task_security_struct *tsec;
3394
3395         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3396         if (!tsec)
3397                 return -ENOMEM;
3398
3399         cred->security = tsec;
3400         return 0;
3401 }
3402
3403 /*
3404  * detach and free the LSM part of a set of credentials
3405  */
3406 static void selinux_cred_free(struct cred *cred)
3407 {
3408         struct task_security_struct *tsec = cred->security;
3409
3410         /*
3411          * cred->security == NULL if security_cred_alloc_blank() or
3412          * security_prepare_creds() returned an error.
3413          */
3414         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3415         cred->security = (void *) 0x7UL;
3416         kfree(tsec);
3417 }
3418
3419 /*
3420  * prepare a new set of credentials for modification
3421  */
3422 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3423                                 gfp_t gfp)
3424 {
3425         const struct task_security_struct *old_tsec;
3426         struct task_security_struct *tsec;
3427
3428         old_tsec = old->security;
3429
3430         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3431         if (!tsec)
3432                 return -ENOMEM;
3433
3434         new->security = tsec;
3435         return 0;
3436 }
3437
3438 /*
3439  * transfer the SELinux data to a blank set of creds
3440  */
3441 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3442 {
3443         const struct task_security_struct *old_tsec = old->security;
3444         struct task_security_struct *tsec = new->security;
3445
3446         *tsec = *old_tsec;
3447 }
3448
3449 /*
3450  * set the security data for a kernel service
3451  * - all the creation contexts are set to unlabelled
3452  */
3453 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3454 {
3455         struct task_security_struct *tsec = new->security;
3456         u32 sid = current_sid();
3457         int ret;
3458
3459         ret = avc_has_perm(sid, secid,
3460                            SECCLASS_KERNEL_SERVICE,
3461                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3462                            NULL);
3463         if (ret == 0) {
3464                 tsec->sid = secid;
3465                 tsec->create_sid = 0;
3466                 tsec->keycreate_sid = 0;
3467                 tsec->sockcreate_sid = 0;
3468         }
3469         return ret;
3470 }
3471
3472 /*
3473  * set the file creation context in a security record to the same as the
3474  * objective context of the specified inode
3475  */
3476 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3477 {
3478         struct inode_security_struct *isec = inode->i_security;
3479         struct task_security_struct *tsec = new->security;
3480         u32 sid = current_sid();
3481         int ret;
3482
3483         ret = avc_has_perm(sid, isec->sid,
3484                            SECCLASS_KERNEL_SERVICE,
3485                            KERNEL_SERVICE__CREATE_FILES_AS,
3486                            NULL);
3487
3488         if (ret == 0)
3489                 tsec->create_sid = isec->sid;
3490         return ret;
3491 }
3492
3493 static int selinux_kernel_module_request(char *kmod_name)
3494 {
3495         u32 sid;
3496         struct common_audit_data ad;
3497
3498         sid = task_sid(current);
3499
3500         ad.type = LSM_AUDIT_DATA_KMOD;
3501         ad.u.kmod_name = kmod_name;
3502
3503         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3504                             SYSTEM__MODULE_REQUEST, &ad);
3505 }
3506
3507 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3508 {
3509         return current_has_perm(p, PROCESS__SETPGID);
3510 }
3511
3512 static int selinux_task_getpgid(struct task_struct *p)
3513 {
3514         return current_has_perm(p, PROCESS__GETPGID);
3515 }
3516
3517 static int selinux_task_getsid(struct task_struct *p)
3518 {
3519         return current_has_perm(p, PROCESS__GETSESSION);
3520 }
3521
3522 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3523 {
3524         *secid = task_sid(p);
3525 }
3526
3527 static int selinux_task_setnice(struct task_struct *p, int nice)
3528 {
3529         int rc;
3530
3531         rc = cap_task_setnice(p, nice);
3532         if (rc)
3533                 return rc;
3534
3535         return current_has_perm(p, PROCESS__SETSCHED);
3536 }
3537
3538 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3539 {
3540         int rc;
3541
3542         rc = cap_task_setioprio(p, ioprio);
3543         if (rc)
3544                 return rc;
3545
3546         return current_has_perm(p, PROCESS__SETSCHED);
3547 }
3548
3549 static int selinux_task_getioprio(struct task_struct *p)
3550 {
3551         return current_has_perm(p, PROCESS__GETSCHED);
3552 }
3553
3554 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3555                 struct rlimit *new_rlim)
3556 {
3557         struct rlimit *old_rlim = p->signal->rlim + resource;
3558
3559         /* Control the ability to change the hard limit (whether
3560            lowering or raising it), so that the hard limit can
3561            later be used as a safe reset point for the soft limit
3562            upon context transitions.  See selinux_bprm_committing_creds. */
3563         if (old_rlim->rlim_max != new_rlim->rlim_max)
3564                 return current_has_perm(p, PROCESS__SETRLIMIT);
3565
3566         return 0;
3567 }
3568
3569 static int selinux_task_setscheduler(struct task_struct *p)
3570 {
3571         int rc;
3572
3573         rc = cap_task_setscheduler(p);
3574         if (rc)
3575                 return rc;
3576
3577         return current_has_perm(p, PROCESS__SETSCHED);
3578 }
3579
3580 static int selinux_task_getscheduler(struct task_struct *p)
3581 {
3582         return current_has_perm(p, PROCESS__GETSCHED);
3583 }
3584
3585 static int selinux_task_movememory(struct task_struct *p)
3586 {
3587         return current_has_perm(p, PROCESS__SETSCHED);
3588 }
3589
3590 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3591                                 int sig, u32 secid)
3592 {
3593         u32 perm;
3594         int rc;
3595
3596         if (!sig)
3597                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3598         else
3599                 perm = signal_to_av(sig);
3600         if (secid)
3601                 rc = avc_has_perm(secid, task_sid(p),
3602                                   SECCLASS_PROCESS, perm, NULL);
3603         else
3604                 rc = current_has_perm(p, perm);
3605         return rc;
3606 }
3607
3608 static int selinux_task_wait(struct task_struct *p)
3609 {
3610         return task_has_perm(p, current, PROCESS__SIGCHLD);
3611 }
3612
3613 static void selinux_task_to_inode(struct task_struct *p,
3614                                   struct inode *inode)
3615 {
3616         struct inode_security_struct *isec = inode->i_security;
3617         u32 sid = task_sid(p);
3618
3619         isec->sid = sid;
3620         isec->initialized = 1;
3621 }
3622
3623 /* Returns error only if unable to parse addresses */
3624 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3625                         struct common_audit_data *ad, u8 *proto)
3626 {
3627         int offset, ihlen, ret = -EINVAL;
3628         struct iphdr _iph, *ih;
3629
3630         offset = skb_network_offset(skb);
3631         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3632         if (ih == NULL)
3633                 goto out;
3634
3635         ihlen = ih->ihl * 4;
3636         if (ihlen < sizeof(_iph))
3637                 goto out;
3638
3639         ad->u.net->v4info.saddr = ih->saddr;
3640         ad->u.net->v4info.daddr = ih->daddr;
3641         ret = 0;
3642
3643         if (proto)
3644                 *proto = ih->protocol;
3645
3646         switch (ih->protocol) {
3647         case IPPROTO_TCP: {
3648                 struct tcphdr _tcph, *th;
3649
3650                 if (ntohs(ih->frag_off) & IP_OFFSET)
3651                         break;
3652
3653                 offset += ihlen;
3654                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3655                 if (th == NULL)
3656                         break;
3657
3658                 ad->u.net->sport = th->source;
3659                 ad->u.net->dport = th->dest;
3660                 break;
3661         }
3662
3663         case IPPROTO_UDP: {
3664                 struct udphdr _udph, *uh;
3665
3666                 if (ntohs(ih->frag_off) & IP_OFFSET)
3667                         break;
3668
3669                 offset += ihlen;
3670                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3671                 if (uh == NULL)
3672                         break;
3673
3674                 ad->u.net->sport = uh->source;
3675                 ad->u.net->dport = uh->dest;
3676                 break;
3677         }
3678
3679         case IPPROTO_DCCP: {
3680                 struct dccp_hdr _dccph, *dh;
3681
3682                 if (ntohs(ih->frag_off) & IP_OFFSET)
3683                         break;
3684
3685                 offset += ihlen;
3686                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3687                 if (dh == NULL)
3688                         break;
3689
3690                 ad->u.net->sport = dh->dccph_sport;
3691                 ad->u.net->dport = dh->dccph_dport;
3692                 break;
3693         }
3694
3695         default:
3696                 break;
3697         }
3698 out:
3699         return ret;
3700 }
3701
3702 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3703
3704 /* Returns error only if unable to parse addresses */
3705 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3706                         struct common_audit_data *ad, u8 *proto)
3707 {
3708         u8 nexthdr;
3709         int ret = -EINVAL, offset;
3710         struct ipv6hdr _ipv6h, *ip6;
3711         __be16 frag_off;
3712
3713         offset = skb_network_offset(skb);
3714         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3715         if (ip6 == NULL)
3716                 goto out;
3717
3718         ad->u.net->v6info.saddr = ip6->saddr;
3719         ad->u.net->v6info.daddr = ip6->daddr;
3720         ret = 0;
3721
3722         nexthdr = ip6->nexthdr;
3723         offset += sizeof(_ipv6h);
3724         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3725         if (offset < 0)
3726                 goto out;
3727
3728         if (proto)
3729                 *proto = nexthdr;
3730
3731         switch (nexthdr) {
3732         case IPPROTO_TCP: {
3733                 struct tcphdr _tcph, *th;
3734
3735                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3736                 if (th == NULL)
3737                         break;
3738
3739                 ad->u.net->sport = th->source;
3740                 ad->u.net->dport = th->dest;
3741                 break;
3742         }
3743
3744         case IPPROTO_UDP: {
3745                 struct udphdr _udph, *uh;
3746
3747                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3748                 if (uh == NULL)
3749                         break;
3750
3751                 ad->u.net->sport = uh->source;
3752                 ad->u.net->dport = uh->dest;
3753                 break;
3754         }
3755
3756         case IPPROTO_DCCP: {
3757                 struct dccp_hdr _dccph, *dh;
3758
3759                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3760                 if (dh == NULL)
3761                         break;
3762
3763                 ad->u.net->sport = dh->dccph_sport;
3764                 ad->u.net->dport = dh->dccph_dport;
3765                 break;
3766         }
3767
3768         /* includes fragments */
3769         default:
3770                 break;
3771         }
3772 out:
3773         return ret;
3774 }
3775
3776 #endif /* IPV6 */
3777
3778 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3779                              char **_addrp, int src, u8 *proto)
3780 {
3781         char *addrp;
3782         int ret;
3783
3784         switch (ad->u.net->family) {
3785         case PF_INET:
3786                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3787                 if (ret)
3788                         goto parse_error;
3789                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3790                                        &ad->u.net->v4info.daddr);
3791                 goto okay;
3792
3793 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3794         case PF_INET6:
3795                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3796                 if (ret)
3797                         goto parse_error;
3798                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3799                                        &ad->u.net->v6info.daddr);
3800                 goto okay;
3801 #endif  /* IPV6 */
3802         default:
3803                 addrp = NULL;
3804                 goto okay;
3805         }
3806
3807 parse_error:
3808         printk(KERN_WARNING
3809                "SELinux: failure in selinux_parse_skb(),"
3810                " unable to parse packet\n");
3811         return ret;
3812
3813 okay:
3814         if (_addrp)
3815                 *_addrp = addrp;
3816         return 0;
3817 }
3818
3819 /**
3820  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3821  * @skb: the packet
3822  * @family: protocol family
3823  * @sid: the packet's peer label SID
3824  *
3825  * Description:
3826  * Check the various different forms of network peer labeling and determine
3827  * the peer label/SID for the packet; most of the magic actually occurs in
3828  * the security server function security_net_peersid_cmp().  The function
3829  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3830  * or -EACCES if @sid is invalid due to inconsistencies with the different
3831  * peer labels.
3832  *
3833  */
3834 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3835 {
3836         int err;
3837         u32 xfrm_sid;
3838         u32 nlbl_sid;
3839         u32 nlbl_type;
3840
3841         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3842         if (unlikely(err))
3843                 return -EACCES;
3844         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3845         if (unlikely(err))
3846                 return -EACCES;
3847
3848         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3849         if (unlikely(err)) {
3850                 printk(KERN_WARNING
3851                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3852                        " unable to determine packet's peer label\n");
3853                 return -EACCES;
3854         }
3855
3856         return 0;
3857 }
3858
3859 /**
3860  * selinux_conn_sid - Determine the child socket label for a connection
3861  * @sk_sid: the parent socket's SID
3862  * @skb_sid: the packet's SID
3863  * @conn_sid: the resulting connection SID
3864  *
3865  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3866  * combined with the MLS information from @skb_sid in order to create
3867  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3868  * of @sk_sid.  Returns zero on success, negative values on failure.
3869  *
3870  */
3871 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3872 {
3873         int err = 0;
3874
3875         if (skb_sid != SECSID_NULL)
3876                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3877         else
3878                 *conn_sid = sk_sid;
3879
3880         return err;
3881 }
3882
3883 /* socket security operations */
3884
3885 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3886                                  u16 secclass, u32 *socksid)
3887 {
3888         if (tsec->sockcreate_sid > SECSID_NULL) {
3889                 *socksid = tsec->sockcreate_sid;
3890                 return 0;
3891         }
3892
3893         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3894                                        socksid);
3895 }
3896
3897 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3898 {
3899         struct sk_security_struct *sksec = sk->sk_security;
3900         struct common_audit_data ad;
3901         struct lsm_network_audit net = {0,};
3902         u32 tsid = task_sid(task);
3903
3904         if (sksec->sid == SECINITSID_KERNEL)
3905                 return 0;
3906
3907         ad.type = LSM_AUDIT_DATA_NET;
3908         ad.u.net = &net;
3909         ad.u.net->sk = sk;
3910
3911         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3912 }
3913
3914 static int selinux_socket_create(int family, int type,
3915                                  int protocol, int kern)
3916 {
3917         const struct task_security_struct *tsec = current_security();
3918         u32 newsid;
3919         u16 secclass;
3920         int rc;
3921
3922         if (kern)
3923                 return 0;
3924
3925         secclass = socket_type_to_security_class(family, type, protocol);
3926         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3927         if (rc)
3928                 return rc;
3929
3930         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3931 }
3932
3933 static int selinux_socket_post_create(struct socket *sock, int family,
3934                                       int type, int protocol, int kern)
3935 {
3936         const struct task_security_struct *tsec = current_security();
3937         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3938         struct sk_security_struct *sksec;
3939         int err = 0;
3940
3941         isec->sclass = socket_type_to_security_class(family, type, protocol);
3942
3943         if (kern)
3944                 isec->sid = SECINITSID_KERNEL;
3945         else {
3946                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3947                 if (err)
3948                         return err;
3949         }
3950
3951         isec->initialized = 1;
3952
3953         if (sock->sk) {
3954                 sksec = sock->sk->sk_security;
3955                 sksec->sid = isec->sid;
3956                 sksec->sclass = isec->sclass;
3957                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3958         }
3959
3960         return err;
3961 }
3962
3963 /* Range of port numbers used to automatically bind.
3964    Need to determine whether we should perform a name_bind
3965    permission check between the socket and the port number. */
3966
3967 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3968 {
3969         struct sock *sk = sock->sk;
3970         u16 family;
3971         int err;
3972
3973         err = sock_has_perm(current, sk, SOCKET__BIND);
3974         if (err)
3975                 goto out;
3976
3977         /*
3978          * If PF_INET or PF_INET6, check name_bind permission for the port.
3979          * Multiple address binding for SCTP is not supported yet: we just
3980          * check the first address now.
3981          */
3982         family = sk->sk_family;
3983         if (family == PF_INET || family == PF_INET6) {
3984                 char *addrp;
3985                 struct sk_security_struct *sksec = sk->sk_security;
3986                 struct common_audit_data ad;
3987                 struct lsm_network_audit net = {0,};
3988                 struct sockaddr_in *addr4 = NULL;
3989                 struct sockaddr_in6 *addr6 = NULL;
3990                 unsigned short snum;
3991                 u32 sid, node_perm;
3992
3993                 if (family == PF_INET) {
3994                         addr4 = (struct sockaddr_in *)address;
3995                         snum = ntohs(addr4->sin_port);
3996                         addrp = (char *)&addr4->sin_addr.s_addr;
3997                 } else {
3998                         addr6 = (struct sockaddr_in6 *)address;
3999                         snum = ntohs(addr6->sin6_port);
4000                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4001                 }
4002
4003                 if (snum) {
4004                         int low, high;
4005
4006                         inet_get_local_port_range(sock_net(sk), &low, &high);
4007
4008                         if (snum < max(PROT_SOCK, low) || snum > high) {
4009                                 err = sel_netport_sid(sk->sk_protocol,
4010                                                       snum, &sid);
4011                                 if (err)
4012                                         goto out;
4013                                 ad.type = LSM_AUDIT_DATA_NET;
4014                                 ad.u.net = &net;
4015                                 ad.u.net->sport = htons(snum);
4016                                 ad.u.net->family = family;
4017                                 err = avc_has_perm(sksec->sid, sid,
4018                                                    sksec->sclass,
4019                                                    SOCKET__NAME_BIND, &ad);
4020                                 if (err)
4021                                         goto out;
4022                         }
4023                 }
4024
4025                 switch (sksec->sclass) {
4026                 case SECCLASS_TCP_SOCKET:
4027                         node_perm = TCP_SOCKET__NODE_BIND;
4028                         break;
4029
4030                 case SECCLASS_UDP_SOCKET:
4031                         node_perm = UDP_SOCKET__NODE_BIND;
4032                         break;
4033
4034                 case SECCLASS_DCCP_SOCKET:
4035                         node_perm = DCCP_SOCKET__NODE_BIND;
4036                         break;
4037
4038                 default:
4039                         node_perm = RAWIP_SOCKET__NODE_BIND;
4040                         break;
4041                 }
4042
4043                 err = sel_netnode_sid(addrp, family, &sid);
4044                 if (err)
4045                         goto out;
4046
4047                 ad.type = LSM_AUDIT_DATA_NET;
4048                 ad.u.net = &net;
4049                 ad.u.net->sport = htons(snum);
4050                 ad.u.net->family = family;
4051
4052                 if (family == PF_INET)
4053                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4054                 else
4055                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4056
4057                 err = avc_has_perm(sksec->sid, sid,
4058                                    sksec->sclass, node_perm, &ad);
4059                 if (err)
4060                         goto out;
4061         }
4062 out:
4063         return err;
4064 }
4065
4066 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4067 {
4068         struct sock *sk = sock->sk;
4069         struct sk_security_struct *sksec = sk->sk_security;
4070         int err;
4071
4072         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4073         if (err)
4074                 return err;
4075
4076         /*
4077          * If a TCP or DCCP socket, check name_connect permission for the port.
4078          */
4079         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4080             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4081                 struct common_audit_data ad;
4082                 struct lsm_network_audit net = {0,};
4083                 struct sockaddr_in *addr4 = NULL;
4084                 struct sockaddr_in6 *addr6 = NULL;
4085                 unsigned short snum;
4086                 u32 sid, perm;
4087
4088                 if (sk->sk_family == PF_INET) {
4089                         addr4 = (struct sockaddr_in *)address;
4090                         if (addrlen < sizeof(struct sockaddr_in))
4091                                 return -EINVAL;
4092                         snum = ntohs(addr4->sin_port);
4093                 } else {
4094                         addr6 = (struct sockaddr_in6 *)address;
4095                         if (addrlen < SIN6_LEN_RFC2133)
4096                                 return -EINVAL;
4097                         snum = ntohs(addr6->sin6_port);
4098                 }
4099
4100                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4101                 if (err)
4102                         goto out;
4103
4104                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4105                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4106
4107                 ad.type = LSM_AUDIT_DATA_NET;
4108                 ad.u.net = &net;
4109                 ad.u.net->dport = htons(snum);
4110                 ad.u.net->family = sk->sk_family;
4111                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4112                 if (err)
4113                         goto out;
4114         }
4115
4116         err = selinux_netlbl_socket_connect(sk, address);
4117
4118 out:
4119         return err;
4120 }
4121
4122 static int selinux_socket_listen(struct socket *sock, int backlog)
4123 {
4124         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4125 }
4126
4127 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4128 {
4129         int err;
4130         struct inode_security_struct *isec;
4131         struct inode_security_struct *newisec;
4132
4133         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4134         if (err)
4135                 return err;
4136
4137         newisec = SOCK_INODE(newsock)->i_security;
4138
4139         isec = SOCK_INODE(sock)->i_security;
4140         newisec->sclass = isec->sclass;
4141         newisec->sid = isec->sid;
4142         newisec->initialized = 1;
4143
4144         return 0;
4145 }
4146
4147 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4148                                   int size)
4149 {
4150         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4151 }
4152
4153 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4154                                   int size, int flags)
4155 {
4156         return sock_has_perm(current, sock->sk, SOCKET__READ);
4157 }
4158
4159 static int selinux_socket_getsockname(struct socket *sock)
4160 {
4161         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4162 }
4163
4164 static int selinux_socket_getpeername(struct socket *sock)
4165 {
4166         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4167 }
4168
4169 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4170 {
4171         int err;
4172
4173         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4174         if (err)
4175                 return err;
4176
4177         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4178 }
4179
4180 static int selinux_socket_getsockopt(struct socket *sock, int level,
4181                                      int optname)
4182 {
4183         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4184 }
4185
4186 static int selinux_socket_shutdown(struct socket *sock, int how)
4187 {
4188         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4189 }
4190
4191 static int selinux_socket_unix_stream_connect(struct sock *sock,
4192                                               struct sock *other,
4193                                               struct sock *newsk)
4194 {
4195         struct sk_security_struct *sksec_sock = sock->sk_security;
4196         struct sk_security_struct *sksec_other = other->sk_security;
4197         struct sk_security_struct *sksec_new = newsk->sk_security;
4198         struct common_audit_data ad;
4199         struct lsm_network_audit net = {0,};
4200         int err;
4201
4202         ad.type = LSM_AUDIT_DATA_NET;
4203         ad.u.net = &net;
4204         ad.u.net->sk = other;
4205
4206         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4207                            sksec_other->sclass,
4208                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4209         if (err)
4210                 return err;
4211
4212         /* server child socket */
4213         sksec_new->peer_sid = sksec_sock->sid;
4214         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4215                                     &sksec_new->sid);
4216         if (err)
4217                 return err;
4218
4219         /* connecting socket */
4220         sksec_sock->peer_sid = sksec_new->sid;
4221
4222         return 0;
4223 }
4224
4225 static int selinux_socket_unix_may_send(struct socket *sock,
4226                                         struct socket *other)
4227 {
4228         struct sk_security_struct *ssec = sock->sk->sk_security;
4229         struct sk_security_struct *osec = other->sk->sk_security;
4230         struct common_audit_data ad;
4231         struct lsm_network_audit net = {0,};
4232
4233         ad.type = LSM_AUDIT_DATA_NET;
4234         ad.u.net = &net;
4235         ad.u.net->sk = other->sk;
4236
4237         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4238                             &ad);
4239 }
4240
4241 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4242                                     u32 peer_sid,
4243                                     struct common_audit_data *ad)
4244 {
4245         int err;
4246         u32 if_sid;
4247         u32 node_sid;
4248
4249         err = sel_netif_sid(ifindex, &if_sid);
4250         if (err)
4251                 return err;
4252         err = avc_has_perm(peer_sid, if_sid,
4253                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4254         if (err)
4255                 return err;
4256
4257         err = sel_netnode_sid(addrp, family, &node_sid);
4258         if (err)
4259                 return err;
4260         return avc_has_perm(peer_sid, node_sid,
4261                             SECCLASS_NODE, NODE__RECVFROM, ad);
4262 }
4263
4264 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4265                                        u16 family)
4266 {
4267         int err = 0;
4268         struct sk_security_struct *sksec = sk->sk_security;
4269         u32 sk_sid = sksec->sid;
4270         struct common_audit_data ad;
4271         struct lsm_network_audit net = {0,};
4272         char *addrp;
4273
4274         ad.type = LSM_AUDIT_DATA_NET;
4275         ad.u.net = &net;
4276         ad.u.net->netif = skb->skb_iif;
4277         ad.u.net->family = family;
4278         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4279         if (err)
4280                 return err;
4281
4282         if (selinux_secmark_enabled()) {
4283                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4284                                    PACKET__RECV, &ad);
4285                 if (err)
4286                         return err;
4287         }
4288
4289         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4290         if (err)
4291                 return err;
4292         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4293
4294         return err;
4295 }
4296
4297 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4298 {
4299         int err;
4300         struct sk_security_struct *sksec = sk->sk_security;
4301         u16 family = sk->sk_family;
4302         u32 sk_sid = sksec->sid;
4303         struct common_audit_data ad;
4304         struct lsm_network_audit net = {0,};
4305         char *addrp;
4306         u8 secmark_active;
4307         u8 peerlbl_active;
4308
4309         if (family != PF_INET && family != PF_INET6)
4310                 return 0;
4311
4312         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4313         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4314                 family = PF_INET;
4315
4316         /* If any sort of compatibility mode is enabled then handoff processing
4317          * to the selinux_sock_rcv_skb_compat() function to deal with the
4318          * special handling.  We do this in an attempt to keep this function
4319          * as fast and as clean as possible. */
4320         if (!selinux_policycap_netpeer)
4321                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4322
4323         secmark_active = selinux_secmark_enabled();
4324         peerlbl_active = selinux_peerlbl_enabled();
4325         if (!secmark_active && !peerlbl_active)
4326                 return 0;
4327
4328         ad.type = LSM_AUDIT_DATA_NET;
4329         ad.u.net = &net;
4330         ad.u.net->netif = skb->skb_iif;
4331         ad.u.net->family = family;
4332         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4333         if (err)
4334                 return err;
4335
4336         if (peerlbl_active) {
4337                 u32 peer_sid;
4338
4339                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4340                 if (err)
4341                         return err;
4342                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4343                                                peer_sid, &ad);
4344                 if (err) {
4345                         selinux_netlbl_err(skb, err, 0);
4346                         return err;
4347                 }
4348                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4349                                    PEER__RECV, &ad);
4350                 if (err) {
4351                         selinux_netlbl_err(skb, err, 0);
4352                         return err;
4353                 }
4354         }
4355
4356         if (secmark_active) {
4357                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4358                                    PACKET__RECV, &ad);
4359                 if (err)
4360                         return err;
4361         }
4362
4363         return err;
4364 }
4365
4366 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4367                                             int __user *optlen, unsigned len)
4368 {
4369         int err = 0;
4370         char *scontext;
4371         u32 scontext_len;
4372         struct sk_security_struct *sksec = sock->sk->sk_security;
4373         u32 peer_sid = SECSID_NULL;
4374
4375         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4376             sksec->sclass == SECCLASS_TCP_SOCKET)
4377                 peer_sid = sksec->peer_sid;
4378         if (peer_sid == SECSID_NULL)
4379                 return -ENOPROTOOPT;
4380
4381         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4382         if (err)
4383                 return err;
4384
4385         if (scontext_len > len) {
4386                 err = -ERANGE;
4387                 goto out_len;
4388         }
4389
4390         if (copy_to_user(optval, scontext, scontext_len))
4391                 err = -EFAULT;
4392
4393 out_len:
4394         if (put_user(scontext_len, optlen))
4395                 err = -EFAULT;
4396         kfree(scontext);
4397         return err;
4398 }
4399
4400 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4401 {
4402         u32 peer_secid = SECSID_NULL;
4403         u16 family;
4404
4405         if (skb && skb->protocol == htons(ETH_P_IP))
4406                 family = PF_INET;
4407         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4408                 family = PF_INET6;
4409         else if (sock)
4410                 family = sock->sk->sk_family;
4411         else
4412                 goto out;
4413
4414         if (sock && family == PF_UNIX)
4415                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4416         else if (skb)
4417                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4418
4419 out:
4420         *secid = peer_secid;
4421         if (peer_secid == SECSID_NULL)
4422                 return -EINVAL;
4423         return 0;
4424 }
4425
4426 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4427 {
4428         struct sk_security_struct *sksec;
4429
4430         sksec = kzalloc(sizeof(*sksec), priority);
4431         if (!sksec)
4432                 return -ENOMEM;
4433
4434         sksec->peer_sid = SECINITSID_UNLABELED;
4435         sksec->sid = SECINITSID_UNLABELED;
4436         selinux_netlbl_sk_security_reset(sksec);
4437         sk->sk_security = sksec;
4438
4439         return 0;
4440 }
4441
4442 static void selinux_sk_free_security(struct sock *sk)
4443 {
4444         struct sk_security_struct *sksec = sk->sk_security;
4445
4446         sk->sk_security = NULL;
4447         selinux_netlbl_sk_security_free(sksec);
4448         kfree(sksec);
4449 }
4450
4451 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4452 {
4453         struct sk_security_struct *sksec = sk->sk_security;
4454         struct sk_security_struct *newsksec = newsk->sk_security;
4455
4456         newsksec->sid = sksec->sid;
4457         newsksec->peer_sid = sksec->peer_sid;
4458         newsksec->sclass = sksec->sclass;
4459
4460         selinux_netlbl_sk_security_reset(newsksec);
4461 }
4462
4463 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4464 {
4465         if (!sk)
4466                 *secid = SECINITSID_ANY_SOCKET;
4467         else {
4468                 struct sk_security_struct *sksec = sk->sk_security;
4469
4470                 *secid = sksec->sid;
4471         }
4472 }
4473
4474 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4475 {
4476         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4477         struct sk_security_struct *sksec = sk->sk_security;
4478
4479         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4480             sk->sk_family == PF_UNIX)
4481                 isec->sid = sksec->sid;
4482         sksec->sclass = isec->sclass;
4483 }
4484
4485 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4486                                      struct request_sock *req)
4487 {
4488         struct sk_security_struct *sksec = sk->sk_security;
4489         int err;
4490         u16 family = req->rsk_ops->family;
4491         u32 connsid;
4492         u32 peersid;
4493
4494         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4495         if (err)
4496                 return err;
4497         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4498         if (err)
4499                 return err;
4500         req->secid = connsid;
4501         req->peer_secid = peersid;
4502
4503         return selinux_netlbl_inet_conn_request(req, family);
4504 }
4505
4506 static void selinux_inet_csk_clone(struct sock *newsk,
4507                                    const struct request_sock *req)
4508 {
4509         struct sk_security_struct *newsksec = newsk->sk_security;
4510
4511         newsksec->sid = req->secid;
4512         newsksec->peer_sid = req->peer_secid;
4513         /* NOTE: Ideally, we should also get the isec->sid for the
4514            new socket in sync, but we don't have the isec available yet.
4515            So we will wait until sock_graft to do it, by which
4516            time it will have been created and available. */
4517
4518         /* We don't need to take any sort of lock here as we are the only
4519          * thread with access to newsksec */
4520         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4521 }
4522
4523 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4524 {
4525         u16 family = sk->sk_family;
4526         struct sk_security_struct *sksec = sk->sk_security;
4527
4528         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4529         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4530                 family = PF_INET;
4531
4532         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4533 }
4534
4535 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4536 {
4537         skb_set_owner_w(skb, sk);
4538 }
4539
4540 static int selinux_secmark_relabel_packet(u32 sid)
4541 {
4542         const struct task_security_struct *__tsec;
4543         u32 tsid;
4544
4545         __tsec = current_security();
4546         tsid = __tsec->sid;
4547
4548         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4549 }
4550
4551 static void selinux_secmark_refcount_inc(void)
4552 {
4553         atomic_inc(&selinux_secmark_refcount);
4554 }
4555
4556 static void selinux_secmark_refcount_dec(void)
4557 {
4558         atomic_dec(&selinux_secmark_refcount);
4559 }
4560
4561 static void selinux_req_classify_flow(const struct request_sock *req,
4562                                       struct flowi *fl)
4563 {
4564         fl->flowi_secid = req->secid;
4565 }
4566
4567 static int selinux_tun_dev_alloc_security(void **security)
4568 {
4569         struct tun_security_struct *tunsec;
4570
4571         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4572         if (!tunsec)
4573                 return -ENOMEM;
4574         tunsec->sid = current_sid();
4575
4576         *security = tunsec;
4577         return 0;
4578 }
4579
4580 static void selinux_tun_dev_free_security(void *security)
4581 {
4582         kfree(security);
4583 }
4584
4585 static int selinux_tun_dev_create(void)
4586 {
4587         u32 sid = current_sid();
4588
4589         /* we aren't taking into account the "sockcreate" SID since the socket
4590          * that is being created here is not a socket in the traditional sense,
4591          * instead it is a private sock, accessible only to the kernel, and
4592          * representing a wide range of network traffic spanning multiple
4593          * connections unlike traditional sockets - check the TUN driver to
4594          * get a better understanding of why this socket is special */
4595
4596         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4597                             NULL);
4598 }
4599
4600 static int selinux_tun_dev_attach_queue(void *security)
4601 {
4602         struct tun_security_struct *tunsec = security;
4603
4604         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4605                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4606 }
4607
4608 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4609 {
4610         struct tun_security_struct *tunsec = security;
4611         struct sk_security_struct *sksec = sk->sk_security;
4612
4613         /* we don't currently perform any NetLabel based labeling here and it
4614          * isn't clear that we would want to do so anyway; while we could apply
4615          * labeling without the support of the TUN user the resulting labeled
4616          * traffic from the other end of the connection would almost certainly
4617          * cause confusion to the TUN user that had no idea network labeling
4618          * protocols were being used */
4619
4620         sksec->sid = tunsec->sid;
4621         sksec->sclass = SECCLASS_TUN_SOCKET;
4622
4623         return 0;
4624 }
4625
4626 static int selinux_tun_dev_open(void *security)
4627 {
4628         struct tun_security_struct *tunsec = security;
4629         u32 sid = current_sid();
4630         int err;
4631
4632         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4633                            TUN_SOCKET__RELABELFROM, NULL);
4634         if (err)
4635                 return err;
4636         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4637                            TUN_SOCKET__RELABELTO, NULL);
4638         if (err)
4639                 return err;
4640         tunsec->sid = sid;
4641
4642         return 0;
4643 }
4644
4645 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4646 {
4647         int err = 0;
4648         u32 perm;
4649         struct nlmsghdr *nlh;
4650         struct sk_security_struct *sksec = sk->sk_security;
4651
4652         if (skb->len < NLMSG_HDRLEN) {
4653                 err = -EINVAL;
4654                 goto out;
4655         }
4656         nlh = nlmsg_hdr(skb);
4657
4658         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4659         if (err) {
4660                 if (err == -EINVAL) {
4661                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4662                                   "SELinux:  unrecognized netlink message"
4663                                   " type=%hu for sclass=%hu\n",
4664                                   nlh->nlmsg_type, sksec->sclass);
4665                         if (!selinux_enforcing || security_get_allow_unknown())
4666                                 err = 0;
4667                 }
4668
4669                 /* Ignore */
4670                 if (err == -ENOENT)
4671                         err = 0;
4672                 goto out;
4673         }
4674
4675         err = sock_has_perm(current, sk, perm);
4676 out:
4677         return err;
4678 }
4679
4680 #ifdef CONFIG_NETFILTER
4681
4682 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4683                                        u16 family)
4684 {
4685         int err;
4686         char *addrp;
4687         u32 peer_sid;
4688         struct common_audit_data ad;
4689         struct lsm_network_audit net = {0,};
4690         u8 secmark_active;
4691         u8 netlbl_active;
4692         u8 peerlbl_active;
4693
4694         if (!selinux_policycap_netpeer)
4695                 return NF_ACCEPT;
4696
4697         secmark_active = selinux_secmark_enabled();
4698         netlbl_active = netlbl_enabled();
4699         peerlbl_active = selinux_peerlbl_enabled();
4700         if (!secmark_active && !peerlbl_active)
4701                 return NF_ACCEPT;
4702
4703         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4704                 return NF_DROP;
4705
4706         ad.type = LSM_AUDIT_DATA_NET;
4707         ad.u.net = &net;
4708         ad.u.net->netif = ifindex;
4709         ad.u.net->family = family;
4710         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4711                 return NF_DROP;
4712
4713         if (peerlbl_active) {
4714                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4715                                                peer_sid, &ad);
4716                 if (err) {
4717                         selinux_netlbl_err(skb, err, 1);
4718                         return NF_DROP;
4719                 }
4720         }
4721
4722         if (secmark_active)
4723                 if (avc_has_perm(peer_sid, skb->secmark,
4724                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4725                         return NF_DROP;
4726
4727         if (netlbl_active)
4728                 /* we do this in the FORWARD path and not the POST_ROUTING
4729                  * path because we want to make sure we apply the necessary
4730                  * labeling before IPsec is applied so we can leverage AH
4731                  * protection */
4732                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4733                         return NF_DROP;
4734
4735         return NF_ACCEPT;
4736 }
4737
4738 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4739                                          struct sk_buff *skb,
4740                                          const struct net_device *in,
4741                                          const struct net_device *out,
4742                                          int (*okfn)(struct sk_buff *))
4743 {
4744         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4745 }
4746
4747 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4748 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4749                                          struct sk_buff *skb,
4750                                          const struct net_device *in,
4751                                          const struct net_device *out,
4752                                          int (*okfn)(struct sk_buff *))
4753 {
4754         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4755 }
4756 #endif  /* IPV6 */
4757
4758 static unsigned int selinux_ip_output(struct sk_buff *skb,
4759                                       u16 family)
4760 {
4761         struct sock *sk;
4762         u32 sid;
4763
4764         if (!netlbl_enabled())
4765                 return NF_ACCEPT;
4766
4767         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4768          * because we want to make sure we apply the necessary labeling
4769          * before IPsec is applied so we can leverage AH protection */
4770         sk = skb->sk;
4771         if (sk) {
4772                 struct sk_security_struct *sksec;
4773
4774                 if (sk->sk_state == TCP_LISTEN)
4775                         /* if the socket is the listening state then this
4776                          * packet is a SYN-ACK packet which means it needs to
4777                          * be labeled based on the connection/request_sock and
4778                          * not the parent socket.  unfortunately, we can't
4779                          * lookup the request_sock yet as it isn't queued on
4780                          * the parent socket until after the SYN-ACK is sent.
4781                          * the "solution" is to simply pass the packet as-is
4782                          * as any IP option based labeling should be copied
4783                          * from the initial connection request (in the IP
4784                          * layer).  it is far from ideal, but until we get a
4785                          * security label in the packet itself this is the
4786                          * best we can do. */
4787                         return NF_ACCEPT;
4788
4789                 /* standard practice, label using the parent socket */
4790                 sksec = sk->sk_security;
4791                 sid = sksec->sid;
4792         } else
4793                 sid = SECINITSID_KERNEL;
4794         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4795                 return NF_DROP;
4796
4797         return NF_ACCEPT;
4798 }
4799
4800 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4801                                         struct sk_buff *skb,
4802                                         const struct net_device *in,
4803                                         const struct net_device *out,
4804                                         int (*okfn)(struct sk_buff *))
4805 {
4806         return selinux_ip_output(skb, PF_INET);
4807 }
4808
4809 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4810                                                 int ifindex,
4811                                                 u16 family)
4812 {
4813         struct sock *sk = skb->sk;
4814         struct sk_security_struct *sksec;
4815         struct common_audit_data ad;
4816         struct lsm_network_audit net = {0,};
4817         char *addrp;
4818         u8 proto;
4819
4820         if (sk == NULL)
4821                 return NF_ACCEPT;
4822         sksec = sk->sk_security;
4823
4824         ad.type = LSM_AUDIT_DATA_NET;
4825         ad.u.net = &net;
4826         ad.u.net->netif = ifindex;
4827         ad.u.net->family = family;
4828         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4829                 return NF_DROP;
4830
4831         if (selinux_secmark_enabled())
4832                 if (avc_has_perm(sksec->sid, skb->secmark,
4833                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4834                         return NF_DROP_ERR(-ECONNREFUSED);
4835
4836         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4837                 return NF_DROP_ERR(-ECONNREFUSED);
4838
4839         return NF_ACCEPT;
4840 }
4841
4842 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4843                                          u16 family)
4844 {
4845         u32 secmark_perm;
4846         u32 peer_sid;
4847         struct sock *sk;
4848         struct common_audit_data ad;
4849         struct lsm_network_audit net = {0,};
4850         char *addrp;
4851         u8 secmark_active;
4852         u8 peerlbl_active;
4853
4854         /* If any sort of compatibility mode is enabled then handoff processing
4855          * to the selinux_ip_postroute_compat() function to deal with the
4856          * special handling.  We do this in an attempt to keep this function
4857          * as fast and as clean as possible. */
4858         if (!selinux_policycap_netpeer)
4859                 return selinux_ip_postroute_compat(skb, ifindex, family);
4860
4861         secmark_active = selinux_secmark_enabled();
4862         peerlbl_active = selinux_peerlbl_enabled();
4863         if (!secmark_active && !peerlbl_active)
4864                 return NF_ACCEPT;
4865
4866         sk = skb->sk;
4867
4868 #ifdef CONFIG_XFRM
4869         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4870          * packet transformation so allow the packet to pass without any checks
4871          * since we'll have another chance to perform access control checks
4872          * when the packet is on it's final way out.
4873          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4874          *       is NULL, in this case go ahead and apply access control.
4875          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4876          *       TCP listening state we cannot wait until the XFRM processing
4877          *       is done as we will miss out on the SA label if we do;
4878          *       unfortunately, this means more work, but it is only once per
4879          *       connection. */
4880         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4881             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4882                 return NF_ACCEPT;
4883 #endif
4884
4885         if (sk == NULL) {
4886                 /* Without an associated socket the packet is either coming
4887                  * from the kernel or it is being forwarded; check the packet
4888                  * to determine which and if the packet is being forwarded
4889                  * query the packet directly to determine the security label. */
4890                 if (skb->skb_iif) {
4891                         secmark_perm = PACKET__FORWARD_OUT;
4892                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4893                                 return NF_DROP;
4894                 } else {
4895                         secmark_perm = PACKET__SEND;
4896                         peer_sid = SECINITSID_KERNEL;
4897                 }
4898         } else if (sk->sk_state == TCP_LISTEN) {
4899                 /* Locally generated packet but the associated socket is in the
4900                  * listening state which means this is a SYN-ACK packet.  In
4901                  * this particular case the correct security label is assigned
4902                  * to the connection/request_sock but unfortunately we can't
4903                  * query the request_sock as it isn't queued on the parent
4904                  * socket until after the SYN-ACK packet is sent; the only
4905                  * viable choice is to regenerate the label like we do in
4906                  * selinux_inet_conn_request().  See also selinux_ip_output()
4907                  * for similar problems. */
4908                 u32 skb_sid;
4909                 struct sk_security_struct *sksec = sk->sk_security;
4910                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4911                         return NF_DROP;
4912                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4913                  * and the packet has been through at least one XFRM
4914                  * transformation then we must be dealing with the "final"
4915                  * form of labeled IPsec packet; since we've already applied
4916                  * all of our access controls on this packet we can safely
4917                  * pass the packet. */
4918                 if (skb_sid == SECSID_NULL) {
4919                         switch (family) {
4920                         case PF_INET:
4921                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4922                                         return NF_ACCEPT;
4923                                 break;
4924                         case PF_INET6:
4925                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4926                                         return NF_ACCEPT;
4927                         default:
4928                                 return NF_DROP_ERR(-ECONNREFUSED);
4929                         }
4930                 }
4931                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4932                         return NF_DROP;
4933                 secmark_perm = PACKET__SEND;
4934         } else {
4935                 /* Locally generated packet, fetch the security label from the
4936                  * associated socket. */
4937                 struct sk_security_struct *sksec = sk->sk_security;
4938                 peer_sid = sksec->sid;
4939                 secmark_perm = PACKET__SEND;
4940         }
4941
4942         ad.type = LSM_AUDIT_DATA_NET;
4943         ad.u.net = &net;
4944         ad.u.net->netif = ifindex;
4945         ad.u.net->family = family;
4946         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4947                 return NF_DROP;
4948
4949         if (secmark_active)
4950                 if (avc_has_perm(peer_sid, skb->secmark,
4951                                  SECCLASS_PACKET, secmark_perm, &ad))
4952                         return NF_DROP_ERR(-ECONNREFUSED);
4953
4954         if (peerlbl_active) {
4955                 u32 if_sid;
4956                 u32 node_sid;
4957
4958                 if (sel_netif_sid(ifindex, &if_sid))
4959                         return NF_DROP;
4960                 if (avc_has_perm(peer_sid, if_sid,
4961                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4962                         return NF_DROP_ERR(-ECONNREFUSED);
4963
4964                 if (sel_netnode_sid(addrp, family, &node_sid))
4965                         return NF_DROP;
4966                 if (avc_has_perm(peer_sid, node_sid,
4967                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4968                         return NF_DROP_ERR(-ECONNREFUSED);
4969         }
4970
4971         return NF_ACCEPT;
4972 }
4973
4974 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
4975                                            struct sk_buff *skb,
4976                                            const struct net_device *in,
4977                                            const struct net_device *out,
4978                                            int (*okfn)(struct sk_buff *))
4979 {
4980         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4981 }
4982
4983 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4984 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
4985                                            struct sk_buff *skb,
4986                                            const struct net_device *in,
4987                                            const struct net_device *out,
4988                                            int (*okfn)(struct sk_buff *))
4989 {
4990         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4991 }
4992 #endif  /* IPV6 */
4993
4994 #endif  /* CONFIG_NETFILTER */
4995
4996 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4997 {
4998         int err;
4999
5000         err = cap_netlink_send(sk, skb);
5001         if (err)
5002                 return err;
5003
5004         return selinux_nlmsg_perm(sk, skb);
5005 }
5006
5007 static int ipc_alloc_security(struct task_struct *task,
5008                               struct kern_ipc_perm *perm,
5009                               u16 sclass)
5010 {
5011         struct ipc_security_struct *isec;
5012         u32 sid;
5013
5014         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5015         if (!isec)
5016                 return -ENOMEM;
5017
5018         sid = task_sid(task);
5019         isec->sclass = sclass;
5020         isec->sid = sid;
5021         perm->security = isec;
5022
5023         return 0;
5024 }
5025
5026 static void ipc_free_security(struct kern_ipc_perm *perm)
5027 {
5028         struct ipc_security_struct *isec = perm->security;
5029         perm->security = NULL;
5030         kfree(isec);
5031 }
5032
5033 static int msg_msg_alloc_security(struct msg_msg *msg)
5034 {
5035         struct msg_security_struct *msec;
5036
5037         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5038         if (!msec)
5039                 return -ENOMEM;
5040
5041         msec->sid = SECINITSID_UNLABELED;
5042         msg->security = msec;
5043
5044         return 0;
5045 }
5046
5047 static void msg_msg_free_security(struct msg_msg *msg)
5048 {
5049         struct msg_security_struct *msec = msg->security;
5050
5051         msg->security = NULL;
5052         kfree(msec);
5053 }
5054
5055 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5056                         u32 perms)
5057 {
5058         struct ipc_security_struct *isec;
5059         struct common_audit_data ad;
5060         u32 sid = current_sid();
5061
5062         isec = ipc_perms->security;
5063
5064         ad.type = LSM_AUDIT_DATA_IPC;
5065         ad.u.ipc_id = ipc_perms->key;
5066
5067         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5068 }
5069
5070 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5071 {
5072         return msg_msg_alloc_security(msg);
5073 }
5074
5075 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5076 {
5077         msg_msg_free_security(msg);
5078 }
5079
5080 /* message queue security operations */
5081 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5082 {
5083         struct ipc_security_struct *isec;
5084         struct common_audit_data ad;
5085         u32 sid = current_sid();
5086         int rc;
5087
5088         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5089         if (rc)
5090                 return rc;
5091
5092         isec = msq->q_perm.security;
5093
5094         ad.type = LSM_AUDIT_DATA_IPC;
5095         ad.u.ipc_id = msq->q_perm.key;
5096
5097         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5098                           MSGQ__CREATE, &ad);
5099         if (rc) {
5100                 ipc_free_security(&msq->q_perm);
5101                 return rc;
5102         }
5103         return 0;
5104 }
5105
5106 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5107 {
5108         ipc_free_security(&msq->q_perm);
5109 }
5110
5111 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5112 {
5113         struct ipc_security_struct *isec;
5114         struct common_audit_data ad;
5115         u32 sid = current_sid();
5116
5117         isec = msq->q_perm.security;
5118
5119         ad.type = LSM_AUDIT_DATA_IPC;
5120         ad.u.ipc_id = msq->q_perm.key;
5121
5122         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5123                             MSGQ__ASSOCIATE, &ad);
5124 }
5125
5126 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5127 {
5128         int err;
5129         int perms;
5130
5131         switch (cmd) {
5132         case IPC_INFO:
5133         case MSG_INFO:
5134                 /* No specific object, just general system-wide information. */
5135                 return task_has_system(current, SYSTEM__IPC_INFO);
5136         case IPC_STAT:
5137         case MSG_STAT:
5138                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5139                 break;
5140         case IPC_SET:
5141                 perms = MSGQ__SETATTR;
5142                 break;
5143         case IPC_RMID:
5144                 perms = MSGQ__DESTROY;
5145                 break;
5146         default:
5147                 return 0;
5148         }
5149
5150         err = ipc_has_perm(&msq->q_perm, perms);
5151         return err;
5152 }
5153
5154 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5155 {
5156         struct ipc_security_struct *isec;
5157         struct msg_security_struct *msec;
5158         struct common_audit_data ad;
5159         u32 sid = current_sid();
5160         int rc;
5161
5162         isec = msq->q_perm.security;
5163         msec = msg->security;
5164
5165         /*
5166          * First time through, need to assign label to the message
5167          */
5168         if (msec->sid == SECINITSID_UNLABELED) {
5169                 /*
5170                  * Compute new sid based on current process and
5171                  * message queue this message will be stored in
5172                  */
5173                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5174                                              NULL, &msec->sid);
5175                 if (rc)
5176                         return rc;
5177         }
5178
5179         ad.type = LSM_AUDIT_DATA_IPC;
5180         ad.u.ipc_id = msq->q_perm.key;
5181
5182         /* Can this process write to the queue? */
5183         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5184                           MSGQ__WRITE, &ad);
5185         if (!rc)
5186                 /* Can this process send the message */
5187                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5188                                   MSG__SEND, &ad);
5189         if (!rc)
5190                 /* Can the message be put in the queue? */
5191                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5192                                   MSGQ__ENQUEUE, &ad);
5193
5194         return rc;
5195 }
5196
5197 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5198                                     struct task_struct *target,
5199                                     long type, int mode)
5200 {
5201         struct ipc_security_struct *isec;
5202         struct msg_security_struct *msec;
5203         struct common_audit_data ad;
5204         u32 sid = task_sid(target);
5205         int rc;
5206
5207         isec = msq->q_perm.security;
5208         msec = msg->security;
5209
5210         ad.type = LSM_AUDIT_DATA_IPC;
5211         ad.u.ipc_id = msq->q_perm.key;
5212
5213         rc = avc_has_perm(sid, isec->sid,
5214                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5215         if (!rc)
5216                 rc = avc_has_perm(sid, msec->sid,
5217                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5218         return rc;
5219 }
5220
5221 /* Shared Memory security operations */
5222 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5223 {
5224         struct ipc_security_struct *isec;
5225         struct common_audit_data ad;
5226         u32 sid = current_sid();
5227         int rc;
5228
5229         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5230         if (rc)
5231                 return rc;
5232
5233         isec = shp->shm_perm.security;
5234
5235         ad.type = LSM_AUDIT_DATA_IPC;
5236         ad.u.ipc_id = shp->shm_perm.key;
5237
5238         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5239                           SHM__CREATE, &ad);
5240         if (rc) {
5241                 ipc_free_security(&shp->shm_perm);
5242                 return rc;
5243         }
5244         return 0;
5245 }
5246
5247 static void selinux_shm_free_security(struct shmid_kernel *shp)
5248 {
5249         ipc_free_security(&shp->shm_perm);
5250 }
5251
5252 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5253 {
5254         struct ipc_security_struct *isec;
5255         struct common_audit_data ad;
5256         u32 sid = current_sid();
5257
5258         isec = shp->shm_perm.security;
5259
5260         ad.type = LSM_AUDIT_DATA_IPC;
5261         ad.u.ipc_id = shp->shm_perm.key;
5262
5263         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5264                             SHM__ASSOCIATE, &ad);
5265 }
5266
5267 /* Note, at this point, shp is locked down */
5268 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5269 {
5270         int perms;
5271         int err;
5272
5273         switch (cmd) {
5274         case IPC_INFO:
5275         case SHM_INFO:
5276                 /* No specific object, just general system-wide information. */
5277                 return task_has_system(current, SYSTEM__IPC_INFO);
5278         case IPC_STAT:
5279         case SHM_STAT:
5280                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5281                 break;
5282         case IPC_SET:
5283                 perms = SHM__SETATTR;
5284                 break;
5285         case SHM_LOCK:
5286         case SHM_UNLOCK:
5287                 perms = SHM__LOCK;
5288                 break;
5289         case IPC_RMID:
5290                 perms = SHM__DESTROY;
5291                 break;
5292         default:
5293                 return 0;
5294         }
5295
5296         err = ipc_has_perm(&shp->shm_perm, perms);
5297         return err;
5298 }
5299
5300 static int selinux_shm_shmat(struct shmid_kernel *shp,
5301                              char __user *shmaddr, int shmflg)
5302 {
5303         u32 perms;
5304
5305         if (shmflg & SHM_RDONLY)
5306                 perms = SHM__READ;
5307         else
5308                 perms = SHM__READ | SHM__WRITE;
5309
5310         return ipc_has_perm(&shp->shm_perm, perms);
5311 }
5312
5313 /* Semaphore security operations */
5314 static int selinux_sem_alloc_security(struct sem_array *sma)
5315 {
5316         struct ipc_security_struct *isec;
5317         struct common_audit_data ad;
5318         u32 sid = current_sid();
5319         int rc;
5320
5321         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5322         if (rc)
5323                 return rc;
5324
5325         isec = sma->sem_perm.security;
5326
5327         ad.type = LSM_AUDIT_DATA_IPC;
5328         ad.u.ipc_id = sma->sem_perm.key;
5329
5330         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5331                           SEM__CREATE, &ad);
5332         if (rc) {
5333                 ipc_free_security(&sma->sem_perm);
5334                 return rc;
5335         }
5336         return 0;
5337 }
5338
5339 static void selinux_sem_free_security(struct sem_array *sma)
5340 {
5341         ipc_free_security(&sma->sem_perm);
5342 }
5343
5344 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5345 {
5346         struct ipc_security_struct *isec;
5347         struct common_audit_data ad;
5348         u32 sid = current_sid();
5349
5350         isec = sma->sem_perm.security;
5351
5352         ad.type = LSM_AUDIT_DATA_IPC;
5353         ad.u.ipc_id = sma->sem_perm.key;
5354
5355         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5356                             SEM__ASSOCIATE, &ad);
5357 }
5358
5359 /* Note, at this point, sma is locked down */
5360 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5361 {
5362         int err;
5363         u32 perms;
5364
5365         switch (cmd) {
5366         case IPC_INFO:
5367         case SEM_INFO:
5368                 /* No specific object, just general system-wide information. */
5369                 return task_has_system(current, SYSTEM__IPC_INFO);
5370         case GETPID:
5371         case GETNCNT:
5372         case GETZCNT:
5373                 perms = SEM__GETATTR;
5374                 break;
5375         case GETVAL:
5376         case GETALL:
5377                 perms = SEM__READ;
5378                 break;
5379         case SETVAL:
5380         case SETALL:
5381                 perms = SEM__WRITE;
5382                 break;
5383         case IPC_RMID:
5384                 perms = SEM__DESTROY;
5385                 break;
5386         case IPC_SET:
5387                 perms = SEM__SETATTR;
5388                 break;
5389         case IPC_STAT:
5390         case SEM_STAT:
5391                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5392                 break;
5393         default:
5394                 return 0;
5395         }
5396
5397         err = ipc_has_perm(&sma->sem_perm, perms);
5398         return err;
5399 }
5400
5401 static int selinux_sem_semop(struct sem_array *sma,
5402                              struct sembuf *sops, unsigned nsops, int alter)
5403 {
5404         u32 perms;
5405
5406         if (alter)
5407                 perms = SEM__READ | SEM__WRITE;
5408         else
5409                 perms = SEM__READ;
5410
5411         return ipc_has_perm(&sma->sem_perm, perms);
5412 }
5413
5414 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5415 {
5416         u32 av = 0;
5417
5418         av = 0;
5419         if (flag & S_IRUGO)
5420                 av |= IPC__UNIX_READ;
5421         if (flag & S_IWUGO)
5422                 av |= IPC__UNIX_WRITE;
5423
5424         if (av == 0)
5425                 return 0;
5426
5427         return ipc_has_perm(ipcp, av);
5428 }
5429
5430 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5431 {
5432         struct ipc_security_struct *isec = ipcp->security;
5433         *secid = isec->sid;
5434 }
5435
5436 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5437 {
5438         if (inode)
5439                 inode_doinit_with_dentry(inode, dentry);
5440 }
5441
5442 static int selinux_getprocattr(struct task_struct *p,
5443                                char *name, char **value)
5444 {
5445         const struct task_security_struct *__tsec;
5446         u32 sid;
5447         int error;
5448         unsigned len;
5449
5450         if (current != p) {
5451                 error = current_has_perm(p, PROCESS__GETATTR);
5452                 if (error)
5453                         return error;
5454         }
5455
5456         rcu_read_lock();
5457         __tsec = __task_cred(p)->security;
5458
5459         if (!strcmp(name, "current"))
5460                 sid = __tsec->sid;
5461         else if (!strcmp(name, "prev"))
5462                 sid = __tsec->osid;
5463         else if (!strcmp(name, "exec"))
5464                 sid = __tsec->exec_sid;
5465         else if (!strcmp(name, "fscreate"))
5466                 sid = __tsec->create_sid;
5467         else if (!strcmp(name, "keycreate"))
5468                 sid = __tsec->keycreate_sid;
5469         else if (!strcmp(name, "sockcreate"))
5470                 sid = __tsec->sockcreate_sid;
5471         else
5472                 goto invalid;
5473         rcu_read_unlock();
5474
5475         if (!sid)
5476                 return 0;
5477
5478         error = security_sid_to_context(sid, value, &len);
5479         if (error)
5480                 return error;
5481         return len;
5482
5483 invalid:
5484         rcu_read_unlock();
5485         return -EINVAL;
5486 }
5487
5488 static int selinux_setprocattr(struct task_struct *p,
5489                                char *name, void *value, size_t size)
5490 {
5491         struct task_security_struct *tsec;
5492         struct task_struct *tracer;
5493         struct cred *new;
5494         u32 sid = 0, ptsid;
5495         int error;
5496         char *str = value;
5497
5498         if (current != p) {
5499                 /* SELinux only allows a process to change its own
5500                    security attributes. */
5501                 return -EACCES;
5502         }
5503
5504         /*
5505          * Basic control over ability to set these attributes at all.
5506          * current == p, but we'll pass them separately in case the
5507          * above restriction is ever removed.
5508          */
5509         if (!strcmp(name, "exec"))
5510                 error = current_has_perm(p, PROCESS__SETEXEC);
5511         else if (!strcmp(name, "fscreate"))
5512                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5513         else if (!strcmp(name, "keycreate"))
5514                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5515         else if (!strcmp(name, "sockcreate"))
5516                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5517         else if (!strcmp(name, "current"))
5518                 error = current_has_perm(p, PROCESS__SETCURRENT);
5519         else
5520                 error = -EINVAL;
5521         if (error)
5522                 return error;
5523
5524         /* Obtain a SID for the context, if one was specified. */
5525         if (size && str[1] && str[1] != '\n') {
5526                 if (str[size-1] == '\n') {
5527                         str[size-1] = 0;
5528                         size--;
5529                 }
5530                 error = security_context_to_sid(value, size, &sid);
5531                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5532                         if (!capable(CAP_MAC_ADMIN)) {
5533                                 struct audit_buffer *ab;
5534                                 size_t audit_size;
5535
5536                                 /* We strip a nul only if it is at the end, otherwise the
5537                                  * context contains a nul and we should audit that */
5538                                 if (str[size - 1] == '\0')
5539                                         audit_size = size - 1;
5540                                 else
5541                                         audit_size = size;
5542                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5543                                 audit_log_format(ab, "op=fscreate invalid_context=");
5544                                 audit_log_n_untrustedstring(ab, value, audit_size);
5545                                 audit_log_end(ab);
5546
5547                                 return error;
5548                         }
5549                         error = security_context_to_sid_force(value, size,
5550                                                               &sid);
5551                 }
5552                 if (error)
5553                         return error;
5554         }
5555
5556         new = prepare_creds();
5557         if (!new)
5558                 return -ENOMEM;
5559
5560         /* Permission checking based on the specified context is
5561            performed during the actual operation (execve,
5562            open/mkdir/...), when we know the full context of the
5563            operation.  See selinux_bprm_set_creds for the execve
5564            checks and may_create for the file creation checks. The
5565            operation will then fail if the context is not permitted. */
5566         tsec = new->security;
5567         if (!strcmp(name, "exec")) {
5568                 tsec->exec_sid = sid;
5569         } else if (!strcmp(name, "fscreate")) {
5570                 tsec->create_sid = sid;
5571         } else if (!strcmp(name, "keycreate")) {
5572                 error = may_create_key(sid, p);
5573                 if (error)
5574                         goto abort_change;
5575                 tsec->keycreate_sid = sid;
5576         } else if (!strcmp(name, "sockcreate")) {
5577                 tsec->sockcreate_sid = sid;
5578         } else if (!strcmp(name, "current")) {
5579                 error = -EINVAL;
5580                 if (sid == 0)
5581                         goto abort_change;
5582
5583                 /* Only allow single threaded processes to change context */
5584                 error = -EPERM;
5585                 if (!current_is_single_threaded()) {
5586                         error = security_bounded_transition(tsec->sid, sid);
5587                         if (error)
5588                                 goto abort_change;
5589                 }
5590
5591                 /* Check permissions for the transition. */
5592                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5593                                      PROCESS__DYNTRANSITION, NULL);
5594                 if (error)
5595                         goto abort_change;
5596
5597                 /* Check for ptracing, and update the task SID if ok.
5598                    Otherwise, leave SID unchanged and fail. */
5599                 ptsid = 0;
5600                 rcu_read_lock();
5601                 tracer = ptrace_parent(p);
5602                 if (tracer)
5603                         ptsid = task_sid(tracer);
5604                 rcu_read_unlock();
5605
5606                 if (tracer) {
5607                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5608                                              PROCESS__PTRACE, NULL);
5609                         if (error)
5610                                 goto abort_change;
5611                 }
5612
5613                 tsec->sid = sid;
5614         } else {
5615                 error = -EINVAL;
5616                 goto abort_change;
5617         }
5618
5619         commit_creds(new);
5620         return size;
5621
5622 abort_change:
5623         abort_creds(new);
5624         return error;
5625 }
5626
5627 static int selinux_ismaclabel(const char *name)
5628 {
5629         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5630 }
5631
5632 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5633 {
5634         return security_sid_to_context(secid, secdata, seclen);
5635 }
5636
5637 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5638 {
5639         return security_context_to_sid(secdata, seclen, secid);
5640 }
5641
5642 static void selinux_release_secctx(char *secdata, u32 seclen)
5643 {
5644         kfree(secdata);
5645 }
5646
5647 /*
5648  *      called with inode->i_mutex locked
5649  */
5650 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5651 {
5652         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5653 }
5654
5655 /*
5656  *      called with inode->i_mutex locked
5657  */
5658 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5659 {
5660         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5661 }
5662
5663 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5664 {
5665         int len = 0;
5666         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5667                                                 ctx, true);
5668         if (len < 0)
5669                 return len;
5670         *ctxlen = len;
5671         return 0;
5672 }
5673 #ifdef CONFIG_KEYS
5674
5675 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5676                              unsigned long flags)
5677 {
5678         const struct task_security_struct *tsec;
5679         struct key_security_struct *ksec;
5680
5681         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5682         if (!ksec)
5683                 return -ENOMEM;
5684
5685         tsec = cred->security;
5686         if (tsec->keycreate_sid)
5687                 ksec->sid = tsec->keycreate_sid;
5688         else
5689                 ksec->sid = tsec->sid;
5690
5691         k->security = ksec;
5692         return 0;
5693 }
5694
5695 static void selinux_key_free(struct key *k)
5696 {
5697         struct key_security_struct *ksec = k->security;
5698
5699         k->security = NULL;
5700         kfree(ksec);
5701 }
5702
5703 static int selinux_key_permission(key_ref_t key_ref,
5704                                   const struct cred *cred,
5705                                   key_perm_t perm)
5706 {
5707         struct key *key;
5708         struct key_security_struct *ksec;
5709         u32 sid;
5710
5711         /* if no specific permissions are requested, we skip the
5712            permission check. No serious, additional covert channels
5713            appear to be created. */
5714         if (perm == 0)
5715                 return 0;
5716
5717         sid = cred_sid(cred);
5718
5719         key = key_ref_to_ptr(key_ref);
5720         ksec = key->security;
5721
5722         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5723 }
5724
5725 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5726 {
5727         struct key_security_struct *ksec = key->security;
5728         char *context = NULL;
5729         unsigned len;
5730         int rc;
5731
5732         rc = security_sid_to_context(ksec->sid, &context, &len);
5733         if (!rc)
5734                 rc = len;
5735         *_buffer = context;
5736         return rc;
5737 }
5738
5739 #endif
5740
5741 static struct security_operations selinux_ops = {
5742         .name =                         "selinux",
5743
5744         .ptrace_access_check =          selinux_ptrace_access_check,
5745         .ptrace_traceme =               selinux_ptrace_traceme,
5746         .capget =                       selinux_capget,
5747         .capset =                       selinux_capset,
5748         .capable =                      selinux_capable,
5749         .quotactl =                     selinux_quotactl,
5750         .quota_on =                     selinux_quota_on,
5751         .syslog =                       selinux_syslog,
5752         .vm_enough_memory =             selinux_vm_enough_memory,
5753
5754         .netlink_send =                 selinux_netlink_send,
5755
5756         .bprm_set_creds =               selinux_bprm_set_creds,
5757         .bprm_committing_creds =        selinux_bprm_committing_creds,
5758         .bprm_committed_creds =         selinux_bprm_committed_creds,
5759         .bprm_secureexec =              selinux_bprm_secureexec,
5760
5761         .sb_alloc_security =            selinux_sb_alloc_security,
5762         .sb_free_security =             selinux_sb_free_security,
5763         .sb_copy_data =                 selinux_sb_copy_data,
5764         .sb_remount =                   selinux_sb_remount,
5765         .sb_kern_mount =                selinux_sb_kern_mount,
5766         .sb_show_options =              selinux_sb_show_options,
5767         .sb_statfs =                    selinux_sb_statfs,
5768         .sb_mount =                     selinux_mount,
5769         .sb_umount =                    selinux_umount,
5770         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5771         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5772         .sb_parse_opts_str =            selinux_parse_opts_str,
5773
5774         .dentry_init_security =         selinux_dentry_init_security,
5775
5776         .inode_alloc_security =         selinux_inode_alloc_security,
5777         .inode_free_security =          selinux_inode_free_security,
5778         .inode_init_security =          selinux_inode_init_security,
5779         .inode_create =                 selinux_inode_create,
5780         .inode_link =                   selinux_inode_link,
5781         .inode_unlink =                 selinux_inode_unlink,
5782         .inode_symlink =                selinux_inode_symlink,
5783         .inode_mkdir =                  selinux_inode_mkdir,
5784         .inode_rmdir =                  selinux_inode_rmdir,
5785         .inode_mknod =                  selinux_inode_mknod,
5786         .inode_rename =                 selinux_inode_rename,
5787         .inode_readlink =               selinux_inode_readlink,
5788         .inode_follow_link =            selinux_inode_follow_link,
5789         .inode_permission =             selinux_inode_permission,
5790         .inode_setattr =                selinux_inode_setattr,
5791         .inode_getattr =                selinux_inode_getattr,
5792         .inode_setxattr =               selinux_inode_setxattr,
5793         .inode_post_setxattr =          selinux_inode_post_setxattr,
5794         .inode_getxattr =               selinux_inode_getxattr,
5795         .inode_listxattr =              selinux_inode_listxattr,
5796         .inode_removexattr =            selinux_inode_removexattr,
5797         .inode_getsecurity =            selinux_inode_getsecurity,
5798         .inode_setsecurity =            selinux_inode_setsecurity,
5799         .inode_listsecurity =           selinux_inode_listsecurity,
5800         .inode_getsecid =               selinux_inode_getsecid,
5801
5802         .file_permission =              selinux_file_permission,
5803         .file_alloc_security =          selinux_file_alloc_security,
5804         .file_free_security =           selinux_file_free_security,
5805         .file_ioctl =                   selinux_file_ioctl,
5806         .mmap_file =                    selinux_mmap_file,
5807         .mmap_addr =                    selinux_mmap_addr,
5808         .file_mprotect =                selinux_file_mprotect,
5809         .file_lock =                    selinux_file_lock,
5810         .file_fcntl =                   selinux_file_fcntl,
5811         .file_set_fowner =              selinux_file_set_fowner,
5812         .file_send_sigiotask =          selinux_file_send_sigiotask,
5813         .file_receive =                 selinux_file_receive,
5814
5815         .file_open =                    selinux_file_open,
5816
5817         .task_create =                  selinux_task_create,
5818         .cred_alloc_blank =             selinux_cred_alloc_blank,
5819         .cred_free =                    selinux_cred_free,
5820         .cred_prepare =                 selinux_cred_prepare,
5821         .cred_transfer =                selinux_cred_transfer,
5822         .kernel_act_as =                selinux_kernel_act_as,
5823         .kernel_create_files_as =       selinux_kernel_create_files_as,
5824         .kernel_module_request =        selinux_kernel_module_request,
5825         .task_setpgid =                 selinux_task_setpgid,
5826         .task_getpgid =                 selinux_task_getpgid,
5827         .task_getsid =                  selinux_task_getsid,
5828         .task_getsecid =                selinux_task_getsecid,
5829         .task_setnice =                 selinux_task_setnice,
5830         .task_setioprio =               selinux_task_setioprio,
5831         .task_getioprio =               selinux_task_getioprio,
5832         .task_setrlimit =               selinux_task_setrlimit,
5833         .task_setscheduler =            selinux_task_setscheduler,
5834         .task_getscheduler =            selinux_task_getscheduler,
5835         .task_movememory =              selinux_task_movememory,
5836         .task_kill =                    selinux_task_kill,
5837         .task_wait =                    selinux_task_wait,
5838         .task_to_inode =                selinux_task_to_inode,
5839
5840         .ipc_permission =               selinux_ipc_permission,
5841         .ipc_getsecid =                 selinux_ipc_getsecid,
5842
5843         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5844         .msg_msg_free_security =        selinux_msg_msg_free_security,
5845
5846         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5847         .msg_queue_free_security =      selinux_msg_queue_free_security,
5848         .msg_queue_associate =          selinux_msg_queue_associate,
5849         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5850         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5851         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5852
5853         .shm_alloc_security =           selinux_shm_alloc_security,
5854         .shm_free_security =            selinux_shm_free_security,
5855         .shm_associate =                selinux_shm_associate,
5856         .shm_shmctl =                   selinux_shm_shmctl,
5857         .shm_shmat =                    selinux_shm_shmat,
5858
5859         .sem_alloc_security =           selinux_sem_alloc_security,
5860         .sem_free_security =            selinux_sem_free_security,
5861         .sem_associate =                selinux_sem_associate,
5862         .sem_semctl =                   selinux_sem_semctl,
5863         .sem_semop =                    selinux_sem_semop,
5864
5865         .d_instantiate =                selinux_d_instantiate,
5866
5867         .getprocattr =                  selinux_getprocattr,
5868         .setprocattr =                  selinux_setprocattr,
5869
5870         .ismaclabel =                   selinux_ismaclabel,
5871         .secid_to_secctx =              selinux_secid_to_secctx,
5872         .secctx_to_secid =              selinux_secctx_to_secid,
5873         .release_secctx =               selinux_release_secctx,
5874         .inode_notifysecctx =           selinux_inode_notifysecctx,
5875         .inode_setsecctx =              selinux_inode_setsecctx,
5876         .inode_getsecctx =              selinux_inode_getsecctx,
5877
5878         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5879         .unix_may_send =                selinux_socket_unix_may_send,
5880
5881         .socket_create =                selinux_socket_create,
5882         .socket_post_create =           selinux_socket_post_create,
5883         .socket_bind =                  selinux_socket_bind,
5884         .socket_connect =               selinux_socket_connect,
5885         .socket_listen =                selinux_socket_listen,
5886         .socket_accept =                selinux_socket_accept,
5887         .socket_sendmsg =               selinux_socket_sendmsg,
5888         .socket_recvmsg =               selinux_socket_recvmsg,
5889         .socket_getsockname =           selinux_socket_getsockname,
5890         .socket_getpeername =           selinux_socket_getpeername,
5891         .socket_getsockopt =            selinux_socket_getsockopt,
5892         .socket_setsockopt =            selinux_socket_setsockopt,
5893         .socket_shutdown =              selinux_socket_shutdown,
5894         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5895         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5896         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5897         .sk_alloc_security =            selinux_sk_alloc_security,
5898         .sk_free_security =             selinux_sk_free_security,
5899         .sk_clone_security =            selinux_sk_clone_security,
5900         .sk_getsecid =                  selinux_sk_getsecid,
5901         .sock_graft =                   selinux_sock_graft,
5902         .inet_conn_request =            selinux_inet_conn_request,
5903         .inet_csk_clone =               selinux_inet_csk_clone,
5904         .inet_conn_established =        selinux_inet_conn_established,
5905         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5906         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5907         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5908         .req_classify_flow =            selinux_req_classify_flow,
5909         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5910         .tun_dev_free_security =        selinux_tun_dev_free_security,
5911         .tun_dev_create =               selinux_tun_dev_create,
5912         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5913         .tun_dev_attach =               selinux_tun_dev_attach,
5914         .tun_dev_open =                 selinux_tun_dev_open,
5915         .skb_owned_by =                 selinux_skb_owned_by,
5916
5917 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5918         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5919         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5920         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5921         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5922         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
5923         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
5924         .xfrm_state_free_security =     selinux_xfrm_state_free,
5925         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5926         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5927         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5928         .xfrm_decode_session =          selinux_xfrm_decode_session,
5929 #endif
5930
5931 #ifdef CONFIG_KEYS
5932         .key_alloc =                    selinux_key_alloc,
5933         .key_free =                     selinux_key_free,
5934         .key_permission =               selinux_key_permission,
5935         .key_getsecurity =              selinux_key_getsecurity,
5936 #endif
5937
5938 #ifdef CONFIG_AUDIT
5939         .audit_rule_init =              selinux_audit_rule_init,
5940         .audit_rule_known =             selinux_audit_rule_known,
5941         .audit_rule_match =             selinux_audit_rule_match,
5942         .audit_rule_free =              selinux_audit_rule_free,
5943 #endif
5944 };
5945
5946 static __init int selinux_init(void)
5947 {
5948         if (!security_module_enable(&selinux_ops)) {
5949                 selinux_enabled = 0;
5950                 return 0;
5951         }
5952
5953         if (!selinux_enabled) {
5954                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5955                 return 0;
5956         }
5957
5958         printk(KERN_INFO "SELinux:  Initializing.\n");
5959
5960         /* Set the security state for the initial task. */
5961         cred_init_security();
5962
5963         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5964
5965         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5966                                             sizeof(struct inode_security_struct),
5967                                             0, SLAB_PANIC, NULL);
5968         avc_init();
5969
5970         if (register_security(&selinux_ops))
5971                 panic("SELinux: Unable to register with kernel.\n");
5972
5973         if (selinux_enforcing)
5974                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5975         else
5976                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5977
5978         return 0;
5979 }
5980
5981 static void delayed_superblock_init(struct super_block *sb, void *unused)
5982 {
5983         superblock_doinit(sb, NULL);
5984 }
5985
5986 void selinux_complete_init(void)
5987 {
5988         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5989
5990         /* Set up any superblocks initialized prior to the policy load. */
5991         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5992         iterate_supers(delayed_superblock_init, NULL);
5993 }
5994
5995 /* SELinux requires early initialization in order to label
5996    all processes and objects when they are created. */
5997 security_initcall(selinux_init);
5998
5999 #if defined(CONFIG_NETFILTER)
6000
6001 static struct nf_hook_ops selinux_ipv4_ops[] = {
6002         {
6003                 .hook =         selinux_ipv4_postroute,
6004                 .owner =        THIS_MODULE,
6005                 .pf =           NFPROTO_IPV4,
6006                 .hooknum =      NF_INET_POST_ROUTING,
6007                 .priority =     NF_IP_PRI_SELINUX_LAST,
6008         },
6009         {
6010                 .hook =         selinux_ipv4_forward,
6011                 .owner =        THIS_MODULE,
6012                 .pf =           NFPROTO_IPV4,
6013                 .hooknum =      NF_INET_FORWARD,
6014                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6015         },
6016         {
6017                 .hook =         selinux_ipv4_output,
6018                 .owner =        THIS_MODULE,
6019                 .pf =           NFPROTO_IPV4,
6020                 .hooknum =      NF_INET_LOCAL_OUT,
6021                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6022         }
6023 };
6024
6025 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6026
6027 static struct nf_hook_ops selinux_ipv6_ops[] = {
6028         {
6029                 .hook =         selinux_ipv6_postroute,
6030                 .owner =        THIS_MODULE,
6031                 .pf =           NFPROTO_IPV6,
6032                 .hooknum =      NF_INET_POST_ROUTING,
6033                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6034         },
6035         {
6036                 .hook =         selinux_ipv6_forward,
6037                 .owner =        THIS_MODULE,
6038                 .pf =           NFPROTO_IPV6,
6039                 .hooknum =      NF_INET_FORWARD,
6040                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6041         }
6042 };
6043
6044 #endif  /* IPV6 */
6045
6046 static int __init selinux_nf_ip_init(void)
6047 {
6048         int err = 0;
6049
6050         if (!selinux_enabled)
6051                 goto out;
6052
6053         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6054
6055         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6056         if (err)
6057                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
6058
6059 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6060         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6061         if (err)
6062                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
6063 #endif  /* IPV6 */
6064
6065 out:
6066         return err;
6067 }
6068
6069 __initcall(selinux_nf_ip_init);
6070
6071 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6072 static void selinux_nf_ip_exit(void)
6073 {
6074         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6075
6076         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
6077 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6078         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
6079 #endif  /* IPV6 */
6080 }
6081 #endif
6082
6083 #else /* CONFIG_NETFILTER */
6084
6085 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6086 #define selinux_nf_ip_exit()
6087 #endif
6088
6089 #endif /* CONFIG_NETFILTER */
6090
6091 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6092 static int selinux_disabled;
6093
6094 int selinux_disable(void)
6095 {
6096         if (ss_initialized) {
6097                 /* Not permitted after initial policy load. */
6098                 return -EINVAL;
6099         }
6100
6101         if (selinux_disabled) {
6102                 /* Only do this once. */
6103                 return -EINVAL;
6104         }
6105
6106         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6107
6108         selinux_disabled = 1;
6109         selinux_enabled = 0;
6110
6111         reset_security_ops();
6112
6113         /* Try to destroy the avc node cache */
6114         avc_disable();
6115
6116         /* Unregister netfilter hooks. */
6117         selinux_nf_ip_exit();
6118
6119         /* Unregister selinuxfs. */
6120         exit_sel_fs();
6121
6122         return 0;
6123 }
6124 #endif